Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The nostr crate for Rust, versions before 0.44.7, has a NIP-04 decryption parser that allocates memory in proportion to malformed input. A remote sender can exploit this by sending an encrypted direct message with many separators or an oversized IV, which can consume memory and CPU in clients that try to decrypt it. Upgrade to nostr 0.44.7 or later. The source does not give a workaround.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 4.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L | OSV |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 15:18 UTC First seen by agentprime
- 31 Oct 2026, 15:18 UTC Confirmed by OSV