CVE-2026-68911

CVE-2026-68911 is a high-severity vulnerability with a CVSS 4.0 base score of 8.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-409.

Key facts

Description

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.

Frequently asked questions

What is CVE-2026-68911?
Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.
How severe is CVE-2026-68911?
CVE-2026-68911 has a CVSS 4.0 base score of 8.7, rated high severity.
Is CVE-2026-68911 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-68911?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-68911 published?
CVE-2026-68911 was published on 2026-09-29 and last updated on 2026-09-30.

References

Other CWE-409 vulnerabilities

Browse all CWE-409 vulnerabilities →