OCTOBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-68911

HIGH · CVSS 8.7 EPSS 0.30% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-29 · Last synced 2026-10-08

CyberRota Analysis

AI-Generated

Nicotine+ versions prior to 3.3.11 are vulnerable to a decompression bomb attack via zlib-compressed peer messages, which can lead to excessive memory consumption and potential denial of service on the recipient's operating system. Users of Nicotine+ should prioritize upgrading to version 3.3.11 to mitigate this high-severity vulnerability. This issue particularly affects individuals and organizations utilizing the Soulseek peer-to-peer network for file sharing.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-68911
Severity
HIGH
CVSS
8.7
EPSS
0.30%

Original NVD Description

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.