CVE-2026-68911
Description
A flaw was found in nicotine-plus. A remote attacker can trigger a Denial of Service (DoS) by sending specially crafted, zlib-compressed peer messages containing a decompression bomb. When the recipient client decompresses the message, it exhausts available operating system memory, causing the application to crash or freeze.
Statement
Red Hat products are not affected by this vulnerability because nicotine-plus is not shipped in any Red Hat product. The nicotine-plus package is only available in Fedora.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
