CVE-2026-121727: Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping contentlength to grow buffers unbounded and exhaust worker memory.