Remote Memory Exhaustion in Net::BitTorrent for Perl

CVE-2026-57080

What is CVE-2026-57080?

The Net::BitTorrent for Perl is susceptible to a remote memory exhaustion issue due to mishandled peer-wire message-length prefixes. This vulnerability arises when the 4-byte length prefix from a peer is accepted without any restrictions. The _process_messages function trusts that this prefix, which could declare a length up to approximately 4 GiB, is valid. As the receive_data method appends incoming bytes to an unconstrained input buffer, an unprivileged peer can exploit this flaw, allowing for excessive memory consumption on the download process. Consequently, this can lead to denial of service as the buffer grows indefinitely, especially since peer connections are unauthenticated and can announce anomalous length prefixes that significantly exceed the legitimate message size of 16 KiB. For further details, refer to the vendor advisory.

References