Kore integer underflow in HTTP body handling exhausts memory
Anyone can make the web server program stop working.
Summary
An integer underflow in Kore's HTTP request body handling lets unauthenticated attackers bypass http_body_max and exhaust server memory with many concurrent POST, PUT or DELETE connections. Versions before 4.3.0 are affected.
What to do
Update to Kore 4.3.0 or later.
Products and platforms
CVE IDs
Sources
- Advisory: kore.io (opens in a new tab)
- Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen