CVE-2026-121727

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121727", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-03T22:17:02.851Z", "datePublished": "2026-11-03T22:55:33.948Z", "dateUpdated": "2026-11-09T15:52:22.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-03T22:55:33.948Z"}, "datePublic": "2026-09-02T00:00:00.000Z", "title": "Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()", "descriptions": [{"lang": "en", "value": "Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer Underflow (Wrap or Wraparound)", "cweId": "CWE-191", "type": "CWE"}]}], "affected": [{"vendor": "jorisvink", "product": "kore", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "4.3.0", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/jorisvink/kore"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/jorisvink/kore", "tags": ["product"]}, {"url": "https://kore.io/releases/4.3.0", "tags": ["release-notes"], "name": "Kore 4.3.0 Release Notes"}, {"url": "https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv"}], "credits": [{"lang": "en", "value": "Tristan Madani", "type": "finder"}, {"lang": "en", "value": "Joris Vink", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T15:52:08.663146Z", "id": "CVE-2026-121727", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T15:52:22.218Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-121727", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T15:52:08.663146Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T15:52:19.103Z"}}], "cna": {"title": "Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()", "credits": [{"lang": "en", "type": "finder", "value": "Tristan Madani"}, {"lang": "en", "type": "remediation developer", "value": "Joris Vink"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "jorisvink", "product": "kore", "versions": [{"status": "affected", "version": "0", "lessThan": "4.3.0", "versionType": "semver"}], "packageURL": "pkg:github/jorisvink/kore", "defaultStatus": "unaffected"}], "datePublic": "2026-09-02T00:00:00.000Z", "references": [{"url": "https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/jorisvink/kore", "tags": ["product"]}, {"url": "https://kore.io/releases/4.3.0", "name": "Kore 4.3.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv", "name": "VulnCheck Advisory: Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "Integer Underflow (Wrap or Wraparound)"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-03T22:55:33.948Z"}}}, "cveMetadata": {"cveId": "CVE-2026-121727", "state": "PUBLISHED", "dateUpdated": "2026-11-09T15:52:22.218Z", "dateReserved": "2026-11-03T22:17:02.851Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-03T22:55:33.948Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/jorisvink/kore", "product": "kore", "vendor": "jorisvink", "versions": [{"lessThan": "4.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory."}], "id": "CVE-2026-121727", "lastModified": "2026-11-12T21:36:06.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-121727", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T15:52:08.663146Z", "version": "2.0.3"}}]}, "published": "2026-11-03T23:17:36.043", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/jorisvink/kore"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b"}, {"source": "disclosure@vulncheck.com", "url": "https://kore.io/releases/4.3.0"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "kore: kore: Denial of Service via integer underflow in HTTP request body handling", "id": "2566583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566583"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.", "A flaw was found in Kore. An unauthenticated remote attacker can trigger an integer underflow in the HTTP request body handling mechanism by sending more body data than declared in the request header. This flaw allows the attacker to bypass configured maximum body size restrictions, resulting in unbounded memory allocation and a Denial of Service (DoS) condition due to memory exhaustion."], "name": "CVE-2026-121727", "public_date": "2026-11-03T22:55:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-121727\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-121727\nhttps://github.com/jorisvink/kore\nhttps://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934\nhttps://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b\nhttps://kore.io/releases/4.3.0\nhttps://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv"], "statement": "This vulnerability is rated as an Important severity because unauthenticated remote attackers can cause complete service starvation through rapid memory exhaustion without requiring privileges or user interaction. Red Hat enterprise products do not package or distribute the Kore web framework, meaning standard platform installations are not exposed to this flaw. Exposure is confined to custom environments where applications are independently built and executed with this third-party framework.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "kore", "source": "cna", "vendor": "jorisvink"}, "product": "kore", "vendor": "jorisvink"}], "created": "2026-11-04T09:15:07.726448+00:00", "updated": "2026-11-06T21:39:44.841996+00:00", "vendors": ["jorisvink", "jorisvink$PRODUCT$kore"]}