CVE-2026-68911

EUVD-2026-88978
Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.
Data Amplification
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.7 HIGH
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.16%
Common Weakness Enumeration
References
https://github.com/nicotine-plus/nicotine-plus/commit/61de347fbaaab02eae1606df4f95d9dc17066d4c
https://github.com/nicotine-plus/nicotine-plus/pull/3646
https://github.com/nicotine-plus/nicotine-plus/releases/tag/3.3.11
https://github.com/nicotine-plus/nicotine-plus/security/advisories/GHSA-8w4c-p7mj-g886