CVE-2026-57080
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In the Net::BitTorrent library for Perl versions up to and including 2.1.0, there is a remote memory exhaustion vulnerability. The issue is the lack of an upper bound on the message-length prefix in the peer-wire framing, allowing a malicious peer to send a huge prefix and stream data, causing unbounded growth of the input buffer.
Risk Assessment
An attacking peer in the BitTorrent swarm can exhaust the memory of the downloading process, resulting in a denial of service (DoS) for applications using this library. Since peer connections are unauthenticated, any swarm participant can launch the attack.
Recommendation
Update the Net::BitTorrent library to version 2.1.1 or later, which includes a fix limiting the maximum message size. If an update is not possible, implement a custom length prefix limit in the application code.
Other vulnerabilities in Net::BitTorrent
See all- CVE-2026-57082Medium
The vulnerability in Net::BitTorrent for Perl before version 2.1.0 generates the MSE Diffie-Hellman private key using a non-cryptographic PRNG based on rand(). This allows a passive observer to recover the PRNG state from cleartext padding, then compute the private key and decrypt the connection.
- CVE-2026-57081High
A vulnerability in the Net::BitTorrent library for Perl (up to version 2.1.0) allows remote memory exhaustion via deeply nested bencoded input. The decoder has no recursion depth limit, and each recursion level keeps a copy of the buffer, causing quadratic memory consumption.
- CVE-2026-57079Medium
A vulnerability in Net::BitTorrent for Perl before version 2.1.0 allows writing files outside the download directory via path traversal in peer-supplied metadata. An attacker can exploit the ut_metadata extension (BEP09) to supply file names containing ".." sequences, bypassing path validation.
Original NVD description (English source)
Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the decoder waits until the buffer holds the full message before processing it, so the buffer grows without limit. Peer connections are unauthenticated, so any peer in the swarm exhausts the downloading process's memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.