Dashboard / CVE-2026-49140

CVE-2026-49140

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-06-01 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: None
VI: None
VA: Low

Description

Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix channel media download handler that allows authenticated room members to exhaust process memory and bandwidth by sending media events with missing or invalid size metadata. Attackers can send multiple concurrent Matrix media events with omitted or invalid declared sizes to trigger simultaneous large media downloads that fully materialize response bodies before post-download rejection, consuming process resources until service degradation occurs.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
HKUDS nanobot 0 < 0.2.1

References & Advisories (4)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.27%
Raw Score 0.002680
Percentile 19.1%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00268
2026-11-12
0.00268
2026-11-10
0.00268
2026-11-09
0.00268
2026-11-08
0.00268

Intelligence Sources

mitre ref →

External Links