Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.5, published 30 October 2026.

Which products and versions are affected?

Anacrolix Torrent v1.61.0 and earlier; github.com/anacrolix/torrent (Go) < 1.61.1-0.20260911233437-76452a2c8a2f, SEMVER:introduced=0,fixed=1.61.1-0.20260911233437-76452a2c8a2f.

How is This vulnerability attacked?

It is attacked over the network or with local access, in a software library.

Check whether you run Anacrolix Torrent or github.com/anacrolix/torrent (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

anacrolix torrent unbounded recursion in bencode decoder

Q: Is there a fix for This vulnerability?

Yes. github.com/anacrolix/torrent (Go): upgrade to 1.61.1-0.20260911233437-76452a2c8a2f or later. Until then: Restrict acceptance of untrusted `.torrent` files and peer-supplied metadata. Applications that ingest torrents programmatically without user interaction should implement input validation or sandboxing of the decoding process. Avoid using the library with attacker-controlled metadata until a patched version is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network or with local access, in a software library.

Q: Am I affected?

Check whether you run Anacrolix Torrent or github.com/anacrolix/torrent (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 6.5 · Published 2026-10-30

anacrolix/torrent is a Go library for BitTorrent client functionality that decodes torrent metadata files and peer-supplied metadata. An attacker can craft a malicious torrent file or send specially crafted metadata through the BitTorrent protocol with deeply nested structures, causing the embedding application to crash with a stack overflow or become unresponsive due to CPU exhaustion.

Technologies: Anacrolix Torrent. Vendors: Anacrolix, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.5, published 30 October 2026.
Which products and versions are affected?: Anacrolix Torrent v1.61.0 and earlier; github.com/anacrolix/torrent (Go) < 1.61.1-0.20260911233437-76452a2c8a2f, SEMVER:introduced=0,fixed=1.61.1-0.20260911233437-76452a2c8a2f.
Is there a fix for This vulnerability?: Yes. github.com/anacrolix/torrent (Go): upgrade to 1.61.1-0.20260911233437-76452a2c8a2f or later. Until then: Restrict acceptance of untrusted `.torrent` files and peer-supplied metadata. Applications that ingest torrents programmatically without user interaction should implement input validation or sandboxing of the decoding process. Avoid using the library with attacker-controlled metadata until a patched version is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network or with local access, in a software library.
Am I affected?: Check whether you run Anacrolix Torrent or github.com/anacrolix/torrent (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/anacrolix/torrent (Go): upgrade to 1.61.1-0.20260911233437-76452a2c8a2f or later
```
go get github.com/anacrolix/torrent@v1.61.1-0.20260911233437-76452a2c8a2f
```

Restrict acceptance of untrusted `.torrent` files and peer-supplied metadata. Applications that ingest torrents programmatically without user interaction should implement input validation or sandboxing of the decoding process. Avoid using the library with attacker-controlled metadata until a patched version is available.

Technical details

The bencode decoder in anacrolix/torrent lacks any limit on nesting depth for dictionaries and lists, allowing unbounded recursion. Defect 1: the `readOneValue` function recurses ~256 bytes per level with no depth counter; a ~8 MB torrent with millions of nested lists exhausts the 1 GiB goroutine stack limit, causing a fatal, unrecoverable stack overflow crash. Defect 2: the `FileTree.UnmarshalBencode` function re-parses subtrees at each level, resulting in O(n²) CPU complexity; a ~0.2 MB v2 info dict with 30,000 nesting levels takes ~66 seconds to decode. Both defects are reachable from attacker-controlled sources: locally via a `.torrent` file or remotely via peer-supplied metadata (within the 16 MiB metadata size limit for magnet/v2 downloads).

Affected products

anacrolix torrent v1.61.0 and earlier

Timeline

2026-10-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.