CVE-2026-51105: aMule Buffer Overflow DoS Vulnerability

CVE-2026-51105 Overview

CVE-2026-51105 is a stack-based buffer overflow [CWE-121] in aMule version 2.3.3, an open-source peer-to-peer file sharing client for the eDonkey and Kad networks. The vulnerability resides in the OP_SERVERMESSAGE handler, which processes messages received from remote eD2K servers. A remote attacker can send a crafted server message to trigger a denial of service against the client. The attack requires no authentication and no user interaction beyond an active server connection.

Critical Impact
Remote attackers can crash aMule 2.3.3 clients over the network by delivering a malformed OP_SERVERMESSAGE packet, disrupting availability without any user interaction.

Affected Products

aMule 2.3.3 (aMULE-Project)
Builds distributed through the aMule project repository at version 2.3.3
Downstream packages of aMule 2.3.3 shipped by Linux and BSD distributions

Discovery Timeline

2026-07-14 - CVE-2026-51105 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-51105

Vulnerability Analysis

The flaw is a stack-based buffer overflow [CWE-121] within the OP_SERVERMESSAGE opcode handler. In the eD2K protocol, servers push status and informational strings to connected clients using this opcode. The handler in aMule 2.3.3 does not correctly bound the length of the incoming string against the destination buffer on the stack. When a server sends an oversized payload, the copy operation writes past the buffer, corrupting adjacent stack data and causing the process to terminate.

The issue is scoped to availability. Confidentiality and integrity are not affected according to the published metrics, and the observed behavior is a client crash rather than code execution.

Root Cause

The root cause is missing length validation in the parser that consumes OP_SERVERMESSAGE packets. The handler trusts the length field controlled by the remote server and copies attacker-supplied bytes into a fixed-size stack buffer. Technical details are tracked in the aMule GitHub issue #445.

Attack Vector

Exploitation requires the victim client to be connected to an attacker-controlled or compromised eD2K server. The attacker sends a crafted OP_SERVERMESSAGE frame with a payload larger than the receive buffer. Because eD2K clients routinely connect to community-run servers, users of aMule 2.3.3 are exposed whenever they select a malicious or hijacked server. No authentication or user interaction is required beyond an active server session.

No public proof-of-concept exploit is listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to the aMule GitHub issue #445 for reproduction details.

Detection Methods for CVE-2026-51105

Indicators of Compromise

Unexpected termination or repeated crashes of the amule or amuled process shortly after connecting to an eD2K server.
Core dumps referencing the OP_SERVERMESSAGE code path or stack-smashing protector aborts in system logs.
Inbound eD2K TCP traffic (default port 4661-4665) containing oversized string payloads within OP_SERVERMESSAGE frames.

Detection Strategies

Inspect eD2K session traffic for OP_SERVERMESSAGE packets where the declared string length exceeds normal server banners.
Correlate aMule process crashes with the source IP of the last connected server to identify malicious peers.
Deploy IDS signatures that flag oversized eD2K opcode 0x38 (OP_SERVERMESSAGE) payloads.

Monitoring Recommendations

Monitor endpoint telemetry for repeated abnormal exits of amule, amuled, or amulegui binaries.
Track outbound connections from user endpoints to eD2K servers and alert on connections to servers with no reputation history.
Retain packet captures on hosts running aMule to support post-incident analysis when a crash occurs.

How to Mitigate CVE-2026-51105

Immediate Actions Required

Inventory all systems running aMule 2.3.3 and prioritize patching or removal.
Restrict aMule clients to trusted eD2K server lists and remove unknown or community-maintained servers until a fix is applied.
Block outbound eD2K traffic at the perimeter for hosts that do not require peer-to-peer functionality.

Patch Information

No fixed vendor release is referenced in the NVD entry for CVE-2026-51105. Track the upstream aMule GitHub issue #445 for remediation status and apply the maintainers' patch as soon as it is published. Distribution package maintainers should rebuild aMule packages once a fixed source revision is available.

Workarounds

Do not connect to untrusted eD2K servers; maintain a curated allowlist of known-good servers.
Run aMule inside a sandbox or container so that a crash cannot affect other services on the host.
Disable eD2K server connections and use only Kad network operation where operationally feasible.
Configure host firewalls to drop unsolicited inbound traffic on aMule ports.

bash

# Example: block outbound eD2K server ports on Linux hosts that do not need aMule
sudo iptables -A OUTPUT -p tcp --dport 4661:4665 -j REJECT
sudo iptables -A OUTPUT -p udp --dport 4665:4672 -j REJECT