Executive brief
Net::BitTorrent is a Perl library used to build BitTorrent clients and tools. A vulnerability in how it processes data allows a remote attacker to crash the application by sending a specially crafted, small message. This can lead to a complete service outage (Denial of Service) for any software using this library when it interacts with malicious peers or files.
Technical details
The bdecode function in Net::BitTorrent::Protocol::BEP03::Bencode lacks a recursion depth limit and suffers from inefficient memory handling. Specifically, each recursive call for nested lists or dictionaries passes the remaining buffer by value, leading to O(N^2) memory consumption relative to the nesting depth. An attacker can provide a small input (approx. 150 KB) containing ~150,000 nested levels to trigger multi-gigabyte memory usage, resulting in a process crash via the OOM killer. This affects all untrusted bencode sources including .torrent files, DHT messages, and tracker responses. As of the advisory, no patch is available; mitigations include implementing a nesting depth cap.
Affected products
- SANKO Net::BitTorrent <= 2.0.1
Timeline
- 2026-06-28: advisory: Original GitHub security advisory published by maintainer
- 2026-06-30: disclosed: CVE-2026-57081 published to NVD