PT-2026-45562 · Hkuds+1 · Nanobot

Hinotoi-Agent · CVE-2026-49140 · Published 2026-06-01 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nanobot versions prior to 0.2.1

Description A denial of service issue exists in the Matrix channel media download handler. Authenticated room members can exhaust process memory and bandwidth by sending media events that lack or contain invalid size metadata. By sending multiple concurrent Matrix media events with omitted or invalid declared sizes, an attacker can trigger simultaneous large media downloads. These downloads fully materialize response bodies before they are rejected post-download, consuming system resources until service degradation occurs.

Recommendations Update Nanobot to version 0.2.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-49140

Affected Products

Nanobot

References · 9

• 🔥 https://github.com/HKUDS/nanobot/pull/4106 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49140.json · Exploit
• https://github.com/HKUDS/nanobot/commit/1d4000560dfff1acb83f5c5ca8ef3ab1f092bd14 · Patch
• https://osv.dev/vulnerability/CVE-2026-49140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49140 · Security Note
• https://github.com/HKUDS/nanobot/releases/tag/v0.2.1 · Note
• https://github.com/HKUDS/nanobot · Note
• https://vulncheck.com/advisories/nanobot-denial-of-service-via-matrix-media-download-handler · Note
• https://t.me/cveNotify/211650 · Telegram Post