UBUNTU-CVE-2026-121727: High severity ubuntu/kore vulnerability

Published Nov 3, 2026

Updated

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping contentlength to grow buffers unbounded and exhaust worker memory.

Affected Software

6 affected components

ubuntu/kore*

Event History

Nov 3, 2026

CVE Published

via OSV·11:17 PM

Data Sourced

via OSV·11:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are affected?

Ubuntu systems using Kore versions earlier than 4.3.0 are affected. Exposure requires the server to accept HTTP POST, PUT, or DELETE requests from an attacker.

Does exploitation require authentication or user interaction?

No. An unauthenticated attacker can exploit the issue remotely, and no user interaction is required.

What is the practical impact of exploitation?

An attacker can send oversized initial request-body segments across many concurrent connections, causing request-body buffers to grow without bound. This can exhaust worker memory and cause a denial of service.

UBUNTU-CVE-2026-121727: High severity ubuntu/kore vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are affected?

Does exploitation require authentication or user interaction?

What is the practical impact of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected?

Does exploitation require authentication or user interaction?

What is the practical impact of exploitation?