Threats tagged 'ghsa-f33j-xw62-gm9f'

Kore versions prior to 4.3.0 have an integer underflow vulnerability in the handling of HTTP request bodies. This flaw allows unauthenticated attackers to bypass the http_body_max limit by sending more body bytes than declared. By sending oversized first segments across many concurrent POST, PUT, or DELETE requests, attackers can cause the content_length value to wrap, leading to unbounded buffer growth and exhaustion of worker memory.