CVE-2026-121727 in Kore
Summary
by MITRE • 11/04/2026
Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The Kore web framework prior to version 4.3.0 contains a critical integer underflow vulnerability within its HTTP request body handling mechanism. This flaw stems from an improper validation of the Content-Length header relative to the actual data received over the network connection. Specifically, when processing incoming requests via POST, PUT, or DELETE methods, the application fails to correctly account for scenarios where the initial segments of a payload are excessively large. By manipulating these first segments, an unauthenticated attacker can cause the internal counter tracking remaining body bytes to wrap around due to integer underflow. This mathematical error results in the system believing that significantly less data remains to be received than is actually being transmitted, thereby bypassing the configured http_body_max limit which is designed to prevent excessive memory consumption from large payloads.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition through resource exhaustion. Because the underflow allows the application to accept and buffer more data than intended, an attacker can exploit multiple concurrent connections to send oversized first segments repeatedly. As each connection triggers the underflow logic, the worker processes allocate memory for these unbounded buffers without ever reaching the termination threshold defined by http_body_max. This leads to a rapid accumulation of allocated memory across all active workers handling such requests. Eventually, this unchecked allocation exhausts the available system or container memory, causing the Kore application to crash, become unresponsive, or trigger out-of-memory kills by the operating system, effectively rendering the service unavailable to legitimate users.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-20 Improper Input Validation within the Common Weakness Enumeration framework. The attack vector is categorized under ATT&CK technique T1498 Network Denial of Service, specifically reflecting indirect impact through resource exhaustion rather than direct network flooding. The lack of authentication required to exploit this flaw significantly increases its risk profile, as any external actor with network access can trigger the condition without needing valid credentials or prior interaction with the application logic beyond initiating a connection.
To mitigate this vulnerability, organizations must immediately upgrade Kore to version 4.3.0 or later where these integer handling checks have been corrected. In environments where immediate patching is not feasible, implementing strict rate limiting and request size validation at the network perimeter using Web Application Firewalls can help block excessively large initial segments before they reach the application layer. Additionally, configuring worker processes with appropriate memory limits via operating system controls such as cgroups or ulimits can provide a secondary defense in depth by preventing any single process from consuming all available host memory, thereby limiting the blast radius of successful exploitation attempts until permanent remediation is applied.