CVE-2026-68911
Received Received - Intake

Memory Exhaustion via Decompression Bomb in Nicotine+

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description
Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-68911
EUVD
EUVD-2026-88978

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nicotine_plus nicotine_plus to 3.3.11 (exc)
nicotine-plus nicotine_plus to 3.3.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nicotine+ is a client for the Soulseek peer-to-peer network. A vulnerability in versions before 3.3.11 allows a remote attacker to send zlib-compressed messages that contain a decompression bomb. This can consume excessive memory on the recipient's system, potentially causing it to crash or become unresponsive.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal memory usage or crashes in Nicotine+ clients. Check for processes consuming excessive memory or logs indicating decompression failures. No specific commands are provided in the context.

Impact Analysis

If you use Nicotine+ versions before 3.3.11, an attacker could exploit this flaw to exhaust your system's memory. This may lead to system slowdowns, crashes, or denial of service, disrupting your ability to use the application or other programs.

Mitigation Strategies

Upgrade Nicotine+ to version 3.3.11 or later to patch the vulnerability. If upgrading is not immediately possible, restrict network access to the application or monitor for suspicious peer messages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart