CVE-2026-49140

The record

Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix channel media download handler that allows authenticated room members to exhaust process memory and bandwidth by sending media events with missing or invalid size metadata. Attackers can send multiple concurrent Matrix media events with omitted or invalid declared sizes to trigger simultaneous large media downloads that fully materialize response bodies before post-download rejection, consuming process resources until service degradation occurs.

Affected packages

Related vulnerabilities

• CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled… CWE-770
• CVE-2026-96377 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined… CWE-770
• CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform… CWE-770
• CVE-2026-114723 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource… CWE-770
• CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory… CWE-770
• CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-770
• CVE-2026-112400 Pillow is a Python imaging library. CWE-770
• CVE-2026-111064 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-770