Is CVE-2026-118689 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-118689?

CVE-2026-118689 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-118689

Description

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.