What is the CVSS score of CVE-2026-51105?

CVE-2026-51105 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of N A are affected by CVE-2026-51105?

aMule 2.3.3 can be remotely crashed by malicious or compromised P2P servers that the client connects to, creating a denial-of-service risk.

How to fix or mitigate CVE-2026-51105?

Within 24 hours: identify all aMule 2.3.3 deployments in the organization and document their business justification. Within 7 days: implement network controls (firewall rules, DNS filtering, or connection allowlisting) to restrict aMule clients to only known-trusted P2P servers, or disable aMule entirely if alternative file-sharing tools are available; communicate workarounds to affected teams. Within 30 days: establish monitoring for a vendor patch from the upstream aMule project; evaluate migration to alternative file-transfer solutions that receive active security maintenance; document organizational policy on P2P client governance.

N A CVE-2026-51105

EUVD-2026-43685 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 mitre

GHSA-7r93-5v7x-h4c9

Buffer Overflow Denial Of Service Stack Overflow N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 16:46 vuln.today

CVSS changed

Jul 14, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jul 14, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 14, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OP_SERVERMESSAGE Handler.

AnalysisAI

Denial of service in aMule 2.3.3 lets a remote eD2k server crash the client by sending a malformed OP_SERVERMESSAGE packet that overflows a stack buffer (CWE-121). The flaw is triggered client-side when parsing server-supplied message data, so any hostile or spoofed server the client connects to can terminate the application. No public exploit has been identified at time of analysis, and the issue is documented only as an upstream bug report (amule GitHub issue #445), not a released patch.