CVE-2026-121727
Description
A flaw was found in Kore. An unauthenticated remote attacker can trigger an integer underflow in the HTTP request body handling mechanism by sending more body data than declared in the request header. This flaw allows the attacker to bypass configured maximum body size restrictions, resulting in unbounded memory allocation and a Denial of Service (DoS) condition due to memory exhaustion.
Statement
This vulnerability is rated as an Important severity because unauthenticated remote attackers can cause complete service starvation through rapid memory exhaustion without requiring privileges or user interaction. Red Hat enterprise products do not package or distribute the Kore web framework, meaning standard platform installations are not exposed to this flaw. Exposure is confined to custom environments where applications are independently built and executed with this third-party framework.
Mitigation
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict buffer offset difference checks against declared content length in HTTP header processing to prevent unbounded body buffer growth: upgrade to Kore 4.3.0, which verify that the buffer offset difference does not exceed the request content length in http_header_recv and return an HTTP 413 error if violated, closing all 2 injection vectors (crafted HTTP requests transmitting more body bytes in the first segment than specified by Content-Length, concurrent HTTP connections causing unbounded buffer growth and worker memory exhaustion). Until patched, this is a concern on Kore HTTP servers exposing endpoints that accept request bodies such as POST, PUT, or DELETE, so restrict network access and limit concurrent requests to endpoints accepting HTTP bodies to prevent memory-exhausting buffer allocations. As a compensating measure, throttle concurrent connections and request rates per client IP to limit flooding that exhausts worker memory and monitor cgroup memory pressure via memory.events and PSI to detect abnormal allocation spikes before worker memory is exhausted. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer underflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-906 Rate Limiting / Connection Throttling (medium)
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Instability
This weakness will generally lead to undefined behavior and therefore crashes. In the case of overflows involving loop index variables, the likelihood of infinite loops is also high.
Integrity
Technical Impact: Modify Memory
If the value in question is important to data (as opposed to flow), simple data corruption has occurred. Also, if the wrap around results in other conditions such as buffer overflows, further memory corruption may occur.
Confidentiality,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism
This weakness can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a program's implicit security policy.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
