CVE-2026-68911

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68911", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-31T21:04:04.040Z", "datePublished": "2026-09-29T14:59:09.588Z", "dateUpdated": "2026-09-29T16:05:09.695Z"}, "containers": {"cna": {"title": "Nicotine+: Decompression of peer messages can exhaust available memory", "problemTypes": [{"descriptions": [{"cweId": "CWE-409", "lang": "en", "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/nicotine-plus/nicotine-plus/security/advisories/GHSA-8w4c-p7mj-g886", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nicotine-plus/nicotine-plus/security/advisories/GHSA-8w4c-p7mj-g886"}, {"name": "https://github.com/nicotine-plus/nicotine-plus/pull/3646", "tags": ["x_refsource_MISC"], "url": "https://github.com/nicotine-plus/nicotine-plus/pull/3646"}, {"name": "https://github.com/nicotine-plus/nicotine-plus/commit/61de347fbaaab02eae1606df4f95d9dc17066d4c", "tags": ["x_refsource_MISC"], "url": "https://github.com/nicotine-plus/nicotine-plus/commit/61de347fbaaab02eae1606df4f95d9dc17066d4c"}, {"name": "https://github.com/nicotine-plus/nicotine-plus/releases/tag/3.3.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/nicotine-plus/nicotine-plus/releases/tag/3.3.11"}], "affected": [{"vendor": "nicotine-plus", "product": "nicotine-plus", "versions": [{"version": "< 3.3.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T14:59:09.588Z"}, "descriptions": [{"lang": "en", "value": "Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11."}], "source": {"advisory": "GHSA-8w4c-p7mj-g886", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T16:04:29.256217Z", "id": "CVE-2026-68911", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T16:05:09.695Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-29T16:04:29.256217Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T16:04:51.711Z"}}], "cna": {"title": "Nicotine+: Decompression of peer messages can exhaust available memory", "source": {"advisory": "GHSA-8w4c-p7mj-g886", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "nicotine-plus", "product": "nicotine-plus", "versions": [{"status": "affected", "version": "< 3.3.11"}]}], "references": [{"url": "https://github.com/nicotine-plus/nicotine-plus/security/advisories/GHSA-8w4c-p7mj-g886", "name": "https://github.com/nicotine-plus/nicotine-plus/security/advisories/GHSA-8w4c-p7mj-g886", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nicotine-plus/nicotine-plus/pull/3646", "name": "https://github.com/nicotine-plus/nicotine-plus/pull/3646", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nicotine-plus/nicotine-plus/commit/61de347fbaaab02eae1606df4f95d9dc17066d4c", "name": "https://github.com/nicotine-plus/nicotine-plus/commit/61de347fbaaab02eae1606df4f95d9dc17066d4c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nicotine-plus/nicotine-plus/releases/tag/3.3.11", "name": "https://github.com/nicotine-plus/nicotine-plus/releases/tag/3.3.11", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-409", "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T14:59:09.588Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68911", "state": "PUBLISHED", "dateUpdated": "2026-09-29T16:05:09.695Z", "dateReserved": "2026-07-31T21:04:04.040Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-29T14:59:09.588Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nicotine-plus", "vendor": "nicotine-plus", "versions": [{"status": "affected", "version": "< 3.3.11"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11."}], "id": "CVE-2026-68911", "lastModified": "2026-09-30T19:57:08.043", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68911", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-29T16:04:29.256217Z", "version": "2.0.3"}}]}, "published": "2026-09-29T15:17:27.647", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nicotine-plus/nicotine-plus/commit/61de347fbaaab02eae1606df4f95d9dc17066d4c"}, {"source": "security-advisories@github.com", "url": "https://github.com/nicotine-plus/nicotine-plus/pull/3646"}, {"source": "security-advisories@github.com", "url": "https://github.com/nicotine-plus/nicotine-plus/releases/tag/3.3.11"}, {"source": "security-advisories@github.com", "url": "https://github.com/nicotine-plus/nicotine-plus/security/advisories/GHSA-8w4c-p7mj-g886"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-409"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nicotine-plus: nicotine-plus: Denial of Service via decompression bomb in peer messages", "id": "2543233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543233"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-409", "details": ["A flaw was found in nicotine-plus. A remote attacker can trigger a Denial of Service (DoS) by sending specially crafted, zlib-compressed peer messages containing a decompression bomb. When the recipient client decompresses the message, it exhausts available operating system memory, causing the application to crash or freeze."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-68911", "public_date": "2026-09-29T14:59:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68911\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68911\nhttps://github.com/nicotine-plus/nicotine-plus/commit/61de347fbaaab02eae1606df4f95d9dc17066d4c\nhttps://github.com/nicotine-plus/nicotine-plus/pull/3646\nhttps://github.com/nicotine-plus/nicotine-plus/releases/tag/3.3.11\nhttps://github.com/nicotine-plus/nicotine-plus/security/advisories/GHSA-8w4c-p7mj-g886"], "statement": "Red Hat products are not affected by this vulnerability because nicotine-plus is not shipped in any Red Hat product. The nicotine-plus package is only available in Fedora.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.11)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "nicotine-plus", "source": "cna", "vendor": "nicotine-plus"}, "product": "nicotine+", "vendor": "nicotine-plus"}], "created": "2026-09-30T01:30:17.835874+00:00", "updated": "2026-09-30T20:30:18.219916+00:00", "vendors": ["nicotine-plus", "nicotine-plus$PRODUCT$nicotine+"]}