Memory Exhaustion Vulnerability in anacrolix/torrent by anacrolix

CVE-2026-123096

What is CVE-2026-123096?

The anacrolix/torrent library prior to version 1.61.0 is susceptible to a memory exhaustion vulnerability due to unbounded responses from malicious HTTP trackers. When attacked, the affected clients can experience crashes due to excessive memory consumption caused by large or gzip-compressed announce or scrape responses received from compromised trackers embedded within torrent files or magnet links. This flaw emphasizes the importance of securing clients against potential denial-of-service scenarios by implementing mechanisms to impose limits on response sizes.

References