Nanobot before version 0.2.1 contains a denial‑of‑service flaw in the Matrix channel media download handler. Authenticated room members can send media events that lack or contain invalid size metadata. Each event triggers a large media download that fully materializes the response body before the server rejects it, exhausting process memory and bandwidth. The result is service degradation or outage, reflecting a CWE‑770 uncontrolled resource consumption vulnerability.

The vulnerability affects the HKUDS Nanobot software under version 0.2.1 and earlier. Users running any Nanobot build that predates the 0.2.1 release are susceptible. No other versions are reported as affected.

The CVSS base score of 5.3 indicates a medium severity impact. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The attack requires authenticated access to a Matrix room where the user is a member; once authenticated, the attacker can flood the server with crafted media events. Although it does not allow arbitrary code execution, repeated exploitation can lead to denial of service. No known public exploit has been documented, but the conditions for successful exploitation are easy to meet for legitimate users.