Description
Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.
Published: 2026-09-29
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via memory exhaustion
Action: Patch
AI Analysis

Impact

The vulnerability lies in the decompression of peer messages within the graphical client. A modified remote client can send a zlib‑compressed packet containing a decompression bomb, causing the recipient’s operating system to allocate excessive memory. This results in a denial of service, disrupting the user’s ability to use the client and potentially destabilizing the system if memory resources are exhausted.

Affected Systems

The affected application is Nicotine+ for the Soulseek peer‑to‑peer network. Versions prior to 3.3.11 are vulnerable, regardless of the operating system on which they run.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can trigger exploitation from a remote peer client without the need for local user interaction, making the risk high. A successful attack would consume system memory and create a denial of service condition.

Generated by OpenCVE AI on September 30, 2026 at 01:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Nicotine+ to version 3.3.11 or later.
  • If an upgrade cannot be performed immediately, restrict peer‑to‑peer connections from unknown or untrusted peers by configuring firewall rules or application settings to limit connections.
  • Monitor system memory usage for abnormal spikes and set alerts to detect potential exploitation attempts early.

Generated by OpenCVE AI on September 30, 2026 at 01:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Nicotine-plus
Nicotine-plus nicotine+
Vendors & Products Nicotine-plus
Nicotine-plus nicotine+

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Tue, 29 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.
Title Nicotine+: Decompression of peer messages can exhaust available memory
Weaknesses CWE-409
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Nicotine-plus Nicotine+
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-29T16:05:09.695Z

Reserved: 2026-07-31T21:04:04.040Z

Link: CVE-2026-68911

cve-icon Vulnrichment

Updated: 2026-09-29T16:04:51.711Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T15:17:27.647

Modified: 2026-09-30T19:57:08.043

Link: CVE-2026-68911

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-29T14:59:09Z

Links: CVE-2026-68911 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T20:30:18Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)