Read the docs
TI-2026-48458 Aliases CVE-2026-68911

Nicotine+: Decompression of peer messages can exhaust available memory

Priority MEDIUM 43CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 23rd percentileScored 2026-11-07
Fix Fixed nicotine-plus (nicotine-plus): 3.3.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nicotine-plusnicotine-plusbefore 3.3.113.3.11Patch availableCNA
  • nicotine-plus Vendornicotine-plus Affected before 3.3.11 Fixed in 3.3.11 Patch available CNA

Remediation

  • Fix · CNA nicotine-plus (nicotine-plus) Fixed in 3.3.11

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68911

References

Other 4

  • TI-2021-20880 Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences