Resource exhaustion in Hkuds Nanobot
CVE-2026-49140
Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix channel media download handler that allows authenticated room members to exhaust process memory and bandwidth by sending media events with missing or invalid size metadata. Attackers can send multiple concurrent Matrix media events with omitted or invalid declared sizes to trigger simultaneous large media downloads that fully materialize response bodies before post-download rejection, consuming process resources until service degradation occurs.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.003 (19.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.003 · change: -0.002
Affected products
- Hkuds Nanobot — versions 0
Weakness classification (CWE)
References
- github.com/HKUDS/nanobot/releases/tag/v0.2.1 (release-notes)
- github.com/HKUDS/nanobot/pull/4106 (issue-tracking)
- github.com/HKUDS/nanobot/commit/1d4000560dfff1acb83f5c5ca8ef3ab1f092bd14 (patch)
- www.vulncheck.com/advisories/nanobot-denial-of-service-via-matrix-media-downloa… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-49140?
- CVE-2026-49140 is a medium-severity vulnerability in Hkuds Nanobot, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 4.3/10. Published 2026-06-01.
- How severe is CVE-2026-49140?
- Medium severity. CVSS v3 base score is 4.3 out of 10.