Is CVE-2026-123096 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123096 being exploited in the wild.

How severe is CVE-2026-123096?

Medium severity, with a CVSS score of 6.5, published 5 November 2026.

Which products and versions are affected?

Anacrolix Torrent through 1.61.0.

Is there a fix for CVE-2026-123096?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-123096 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123096?

Check whether you run Anacrolix Torrent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123096: anacrolix/torrent memory exhaustion in tracker HTTP

CVE-2026-123096 · Severity: medium · CVSS 6.5 · Published 2026-11-05

The anacrolix/torrent BitTorrent client library buffers HTTP responses from trackers without size limits, allowing a malicious tracker to crash client processes by returning extremely large or heavily compressed responses. An attacker controlling a tracker referenced in a torrent file or magnet link can exhaust a client's memory, causing a denial of service and disrupting file-sharing operations.

Technologies: Anacrolix Torrent. Vendors: Anacrolix.

Quick answers

Is CVE-2026-123096 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123096 being exploited in the wild.
How severe is CVE-2026-123096?: Medium severity, with a CVSS score of 6.5, published 5 November 2026.
Which products and versions are affected?: Anacrolix Torrent through 1.61.0.
Is there a fix for CVE-2026-123096?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-123096 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123096?: Check whether you run Anacrolix Torrent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the tracker/http package's Client.Announce and Client.Scrape methods, which buffer unbounded HTTP responses without memory limits. Attackers can exploit this by returning oversized or gzip-compressed tracker responses that decompress to enormous sizes. The issue affects all versions through 1.61.0 and requires network access to a tracker endpoint that clients will connect to.

Affected products

anacrolix torrent through 1.61.0

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.