CVE-2026-51376: BitChat for iOS Denial of Service Vulnerability

CVE-2026-51376 Overview

CVE-2026-51376 is a denial-of-service vulnerability affecting BitChat for iOS version 1.15.0. The flaw resides in the mesh gossip cache, which accepts unauthenticated MESSAGE packets from adjacent Bluetooth Low Energy (BLE) peers. A remote attacker within BLE range can flood or poison the cache without any authentication, exhausting resources and disrupting mesh communications for legitimate users. The vulnerability is categorized under [CWE-444] Inconsistent Interpretation of HTTP Requests, applied here to the protocol handling within BitChat's peer-to-peer mesh layer.

Critical Impact
An adjacent attacker can inject unauthenticated mesh packets to degrade or disable BitChat availability on iOS devices without user interaction.

Affected Products

BitChat for iOS v1.15.0
BitChat mesh gossip cache component
BLE-based mesh peer implementations bundled with the affected release

Discovery Timeline

2026-08-28 - CVE-2026-51376 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51376

Vulnerability Analysis

BitChat implements a decentralized mesh network over BLE, using a gossip protocol to relay MESSAGE packets between peers. In version 1.15.0, the gossip cache ingests inbound packets without verifying sender identity or applying rate controls. An attacker within BLE range can transmit crafted MESSAGE packets that the client stores and propagates.

Because the cache lacks authentication and validation, adversary-supplied packets consume memory and processing time reserved for legitimate mesh traffic. The result is resource exhaustion that degrades or halts message delivery. The published research from Barghest describes the cache-poisoning behavior and provides a reproducible proof-of-concept targeting iOS clients.

Root Cause

The root cause is missing authentication and integrity checks on inbound gossip messages. The gossip cache treats any BLE peer as an authorized message source. Combined with insufficient bounds on cache size and turnover, this design permits an unauthenticated attacker to overwhelm the store with attacker-controlled entries and starve legitimate messages.

Attack Vector

Exploitation requires adjacent-network access, specifically BLE proximity to a target device running BitChat 1.15.0. The attacker sends malformed or high-volume MESSAGE packets into the mesh. No credentials, user interaction, or prior pairing are required. Impact is limited to availability; confidentiality and integrity are not directly affected.

No verified exploitation code is reproduced here. See the Barghest cache poisoning analysis and the BARGHEST proof-of-concept repository for technical details.

Detection Methods for CVE-2026-51376

Indicators of Compromise

Sudden spikes in BLE traffic volume from unknown or unpaired peers near iOS devices running BitChat.
BitChat application becoming unresponsive, crashing, or failing to relay messages while BLE is active.
Elevated memory or CPU consumption attributed to the BitChat process during periods of BLE activity.

Detection Strategies

Monitor mobile telemetry for abnormal BitChat resource usage patterns tied to BLE scanning or advertising activity.
Correlate crash reports referencing gossip cache or mesh message-handling code paths in BitChat 1.15.0.
Inspect BLE packet captures in sensitive environments for repeated MESSAGE frames sourced from unauthenticated peers.

Monitoring Recommendations

Track BitChat version inventory across managed iOS fleets and flag devices still running 1.15.0.
Alert on unexpected BLE peer density in physical zones where BitChat is used operationally.
Review mobile device management (MDM) logs for BitChat crash signatures following the disclosure date.

How to Mitigate CVE-2026-51376

Immediate Actions Required

Upgrade BitChat for iOS beyond version 1.15.0 once a fixed release incorporating Pull Request #998 is published.
Disable BitChat or restrict its use in untrusted public environments where BLE-adjacent attackers may be present.
Restrict BLE exposure by keeping devices in areas with vetted physical access when active mesh participation is required.

Patch Information

The upstream project has proposed a fix through BitChat Pull Request #998, which addresses the gossip cache handling of unauthenticated MESSAGE packets. Users should track that pull request and upgrade to the first release that merges the corresponding changes. Additional context is available in the Barghest disclosure.

Workarounds

Turn off BLE on iOS devices when BitChat is not actively required.
Limit BitChat use to trusted physical environments until a patched version is installed.
Enforce mobile application allowlists through MDM to temporarily block BitChat 1.15.0 on managed devices.

bash

# Example MDM query to identify affected iOS devices
# Filter installed apps for BitChat version 1.15.0
mdm-cli apps list --bundle-id chat.bitchat --version 1.15.0