{"id":"CVE-2021-45848","aliases":["EUVD-2022-1488","GHSA-p4v2-r99v-wjc2","PYSEC-2026-687"],"status":"published","title":"Nicotine+ DoS on Null Character in Download Request","description":"Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01624,"percentile":0.76297,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2022-03-15T00:00:00Z","modified":"2026-10-20T10:55:09Z","fixes":[{"ecosystem":"PyPI","package":"nicotine-plus","fixed_in":["3.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"nicotine-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nicotine-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3"},{"fixed":"3.2.1"}]}],"versions":["3.0.3","3.0.4","3.0.5","3.0.6","3.1.0","3.1.1","3.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"nicotine-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3"},{"fixed":"3.2.1"}]}],"versions":["3.0.3","3.0.4","3.0.5","3.0.6","3.1.0","3.1.1","3.2.0"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nicotine-plus","product":"nicotine\\+"}],"references":[{"url":"https://github.com/nicotine-plus/nicotine-plus/issues/1777","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWYV53KERFH2EC4XI2IVVQFTV75E5XM6/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202210-20","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45848","tags":["advisory"]},{"url":"https://github.com/nicotine-plus/nicotine-plus/commit/0e3e2fac27a518f0a84330f1ddf1193424522045","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWYV53KERFH2EC4XI2IVVQFTV75E5XM6/"},{"url":"https://github.com/advisories/GHSA-p4v2-r99v-wjc2","tags":["advisory"]},{"url":"https://github.com/nicotine-plus/nicotine-plus","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWYV53KERFH2EC4XI2IVVQFTV75E5XM6","tags":["web"]},{"url":"https://pypi.org/project/nicotine-plus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-45848","description":"Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.","status":"published","published":"2022-03-15T00:00:00Z","modified":"2024-08-04T04:54:31.095Z","updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2022-1488","description":"Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.","status":"published","published":"2022-03-15T00:00:00Z","modified":"2024-08-04T04:54:31Z","updated_at":"2026-11-03T03:08:24.682864Z"}],"ghsa":[{"id":"GHSA-p4v2-r99v-wjc2","title":"Nicotine+ DoS on Null Character in Download Request","description":"Denial of service (DoS) vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.","status":"published","published":"2022-03-16T00:00:38Z","modified":"2023-09-05T19:58:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2021-45848","description":"Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.","status":"published","published":"2022-03-15T19:15:07.84Z","modified":"2026-06-17T04:14:09.737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:07:05.198719Z"}],"osv":[{"id":"CVE-2021-45848","description":"Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.","status":"published","published":"2022-03-15T19:15:07.84Z","modified":"2026-10-20T10:55:09.660658802Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:22.18434Z"},{"id":"GHSA-p4v2-r99v-wjc2","title":"Nicotine+ DoS on Null Character in Download Request","description":"Denial of service (DoS) vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.","status":"published","published":"2022-03-16T00:00:38Z","modified":"2026-07-06T08:11:37.590012614Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"PYSEC-2026-687","title":"Nicotine+ DoS on Null Character in Download Request","description":"Denial of service (DoS) vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.","status":"published","published":"2026-07-02T14:13:16.407927Z","modified":"2026-07-06T08:00:47.602203985Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"}]}}