CVE-2026-51376

Deferred Deferred - Pending Action

BitChat iOS Denial of Service via Unauthenticated MESSAGE Packet

Publication date: 2026-08-28

Last updated on: 2026-09-01

Assigner: MITRE

Description

An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-01

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-51376

EUVD

EUVD-2026-67916

Affected Vendors & Products

Vendor	Product	Version / Range
bitchat	bitchat	1.15.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability in BitChat for iOS v1.15.0 allows a remote attacker to send an unauthenticated MESSAGE packet into the mesh gossip cache, causing a denial of service. The flaw stems from weaknesses in the BLE cache mechanism that let unauthorized data persist and propagate through the network without proper validation.

Detection Guidance

To detect this vulnerability, use the provided Proof of Concept (PoC) script from Resource 1. Run `python3 barghest.py --scan` to identify vulnerable BitChat 1.15.0 iOS devices on your network. If a device is found, execute `python3 barghest.py --target` to test for cache poisoning susceptibility.

Impact Analysis

An attacker could exploit this to disrupt messaging services by injecting spam, spoofed messages, or causing network congestion. The attack may degrade reliable message delivery and allow unauthorized data to spread across the mesh network without further attacker involvement.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized message injection and denial-of-service attacks in a peer-to-peer messaging system. Unauthenticated data persistence and propagation through the network may violate data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Update BitChat to the patched version (1.5.1 or later) to address the authentication bypass and cache poisoning issues. Ensure all iOS devices running BitChat apply the latest security fixes immediately. Disable BLE mesh networking if not required until updates are applied.

Hi! I’m here to help you understand CVE-2026-51376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70