CVE-2026-49140

Katalog CVE

CVSS 4.3 · Medium EPSS 0,47%

Kerentanan Allocation of Resources Without Limits or Throttling. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix channel media download handler that allows authenticated room members to exhaust process memory and bandwidth by sending media events with missing or invalid size metadata. Attackers can send multiple concurrent Matrix media events with omitted or invalid declared sizes to trigger simultaneous large media downloads that fully materialize response bodies before post-download rejection, consuming process resources until service degradation occurs.

Rincian

Terbit di NVD

1 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Deferred

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/HKUDS/nanobot/commit/1d4000560dfff1acb83f5c5ca8ef3ab1f092bd14
• https://github.com/HKUDS/nanobot/pull/4106
• https://github.com/HKUDS/nanobot/releases/tag/v0.2.1
• https://www.vulncheck.com/advisories/nanobot-denial-of-service-via-matrix-media-download-handler