Nicotine+ CVE-2026-68911

Requires the attacker to operate a modified Soulseek client and establish a peer-to-peer connection to a Nicotine+ instance older than 3.3.11, then send a zlib-compressed peer message crafted as a decompression bomb. No authentication (PR:N) and no user interaction (UI:N) are needed beyond the victim participating in the Soulseek network with the default vulnerable code path that decompressed peer messages without an uncompressed-size cap. Limiting factor: the attacker must be a reachable/connected peer on the Soulseek network, and the only impact is availability (memory exhaustion / OS DoS) - no data access or code execution.

This is a genuine but bounded-severity availability issue. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, VC:N/VI:N) scores 8.7 (High), but the entire score is driven by availability alone - there is no confidentiality or integrity impact. In CVSS 3.1 terms this maps to roughly 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): a pure denial-of-service via memory exhaustion. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The high CVSS is somewhat inflated relative to real-world priority: the affected product (Nicotine+, a Soulseek P2P client) has a small, niche user base, the impact is a crash/OOM rather than code execution or data theft, and exploitation requires the attacker to be a connected Soulseek peer. Net: a real, easily-triggered DoS but low-to-medium operational priority given niche deployment and availability-only impact. Note the input Tag 'Information Disclosure' directly contradicts the CVSS vector (VC:N) and CWE-409 - this is a data-amplification DoS, not an information-disclosure bug.

An attacker runs a modified Soulseek client and establishes a peer connection to a victim running Nicotine+ prior to 3.3.11. The attacker sends a zlib-compressed peer message that is a decompression bomb (a tiny payload expanding to gigabytes); the victim's client decompresses it without bounds, exhausting operating-system memory and crashing the host. No authentication or user interaction is required beyond normal P2P peer connectivity, and no public exploit code is currently identified.