Nicotine-plus vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Nicotine-plus products: 1 record(s), with severity, exploitation and fixes.

Nicotine-plus 1

Exploited only (KEV) →

CVE-2026-68911 High · 8.7 CWE-409 Sep 29, 2026

Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.