# anacrolix torrent unbounded recursion in bencode decoder

Source: https://junglewise.ai/threats/anacrolix-torrent-has-unbounded-recursion-in-the-bencode-decoder-that-a1cc4a62  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2026-10-30

anacrolix/torrent is a Go library for BitTorrent client functionality that decodes torrent metadata files and peer-supplied metadata. An attacker can craft a malicious torrent file or send specially crafted metadata through the BitTorrent protocol with deeply nested structures, causing the embedding application to crash with a stack overflow or become unresponsive due to CPU exhaustion.

Technologies: [Anacrolix Torrent](https://junglewise.ai/threats/technologies/torrent). Vendors: [Anacrolix](https://junglewise.ai/threats/vendors/anacrolix), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 30 October 2026.

**Which products and versions are affected?** Anacrolix Torrent v1.61.0 and earlier; github.com/anacrolix/torrent (Go) < 1.61.1-0.20260911233437-76452a2c8a2f, SEMVER:introduced=0,fixed=1.61.1-0.20260911233437-76452a2c8a2f.

**Is there a fix for This vulnerability?** Yes. github.com/anacrolix/torrent (Go): upgrade to 1.61.1-0.20260911233437-76452a2c8a2f or later. Until then: Restrict acceptance of untrusted `.torrent` files and peer-supplied metadata. Applications that ingest torrents programmatically without user interaction should implement input validation or sandboxing of the decoding process. Avoid using the library with attacker-controlled metadata until a patched version is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected?** Check whether you run Anacrolix Torrent or github.com/anacrolix/torrent (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/anacrolix/torrent (Go): upgrade to 1.61.1-0.20260911233437-76452a2c8a2f or later

  ```sh
  go get github.com/anacrolix/torrent@v1.61.1-0.20260911233437-76452a2c8a2f
  ```


Restrict acceptance of untrusted `.torrent` files and peer-supplied metadata. Applications that ingest torrents programmatically without user interaction should implement input validation or sandboxing of the decoding process. Avoid using the library with attacker-controlled metadata until a patched version is available.

## Technical details

The bencode decoder in anacrolix/torrent lacks any limit on nesting depth for dictionaries and lists, allowing unbounded recursion. Defect 1: the `readOneValue` function recurses ~256 bytes per level with no depth counter; a ~8 MB torrent with millions of nested lists exhausts the 1 GiB goroutine stack limit, causing a fatal, unrecoverable stack overflow crash. Defect 2: the `FileTree.UnmarshalBencode` function re-parses subtrees at each level, resulting in O(n²) CPU complexity; a ~0.2 MB v2 info dict with 30,000 nesting levels takes ~66 seconds to decode. Both defects are reachable from attacker-controlled sources: locally via a `.torrent` file or remotely via peer-supplied metadata (within the 16 MiB metadata size limit for magnet/v2 downloads).

## Affected products

- anacrolix torrent v1.61.0 and earlier

## Timeline

- 2026-10-30: disclosed

## Related threats

- [anacrolix torrent unbounded recursion in bencode decoder](https://junglewise.ai/threats/go-2026-6894-anacrolix-torrent-has-unbounded-recursion-in-the-bencode-590d3a6a)
- [anacrolix/torrent memory exhaustion in tracker HTTP](https://junglewise.ai/threats/cve-2026-123096-anacrolix-torrent-through-1-61-0-contains-a-memory-exhaustion)