8.7
CVE-2026-68911
- EPSS 0.3%
- Veröffentlicht 29.09.2026 15:17:27
- Zuletzt bearbeitet 30.09.2026 19:57:08
- Erkennungen
Nicotine+: Decompression of peer messages can exhaust available memory
Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellernicotine-plus
≫
Produkt
nicotine-plus
Version
< 3.3.11
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.3% | 0.207 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 8.7 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
https://github.com/nicotine-plus/nicotine-plus/commit/61de347fbaaab02eae1606df4f95d9dc17066d4c
https://github.com/nicotine-plus/nicotine-plus/pull/3646
https://github.com/nicotine-plus/nicotine-plus/releases/tag/3.3.11
https://github.com/nicotine-plus/nicotine-plus/security/advisories/GHSA-8w4c-p7mj-g886