Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 5 November 2026.

Which products and versions are affected?

Anacrolix Torrent 1.61.0 and earlier; github.com/anacrolix/torrent (Go) SEMVER:introduced=0,fixed=1.61.1-0.20260911233437-76452a2c8a2f.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Anacrolix Torrent or github.com/anacrolix/torrent (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

anacrolix torrent unbounded recursion in bencode decoder

Severity: info · Published 2026-11-05

anacrolix torrent is a Go library for handling torrent files and peer communication. An attacker can craft a torrent file or malicious metadata with deeply nested structures that causes the decoder to consume excessive CPU or crash the entire process via stack overflow, making the application unavailable.

Technologies: Anacrolix Torrent. Vendors: Anacrolix, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 5 November 2026.
Which products and versions are affected?: Anacrolix Torrent 1.61.0 and earlier; github.com/anacrolix/torrent (Go) SEMVER:introduced=0,fixed=1.61.1-0.20260911233437-76452a2c8a2f.
Is there a fix for This vulnerability?: Yes. github.com/anacrolix/torrent (Go): upgrade to 1.61.1-0.20260911233437-76452a2c8a2f or later. Until then: Restrict acceptance of .torrent files and peer metadata to trusted sources; implement external resource limits (process memory or CPU timeout) to contain DoS impact until an upgrade is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Anacrolix Torrent or github.com/anacrolix/torrent (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/anacrolix/torrent (Go): upgrade to 1.61.1-0.20260911233437-76452a2c8a2f or later
```
go get github.com/anacrolix/torrent@v1.61.1-0.20260911233437-76452a2c8a2f
```

Restrict acceptance of .torrent files and peer metadata to trusted sources; implement external resource limits (process memory or CPU timeout) to contain DoS impact until an upgrade is possible.

Technical details

The bencode decoder in the bencode package applies no limit to the nesting depth of dictionaries and lists, leading to two distinct DoS mechanisms: unbounded recursion in readOneValue (stack overflow crash after ~8 MB of nested lists) and quadratic CPU exhaustion via FileTree.UnmarshalBencode's repeated re-parsing of subtrees at each nesting level. Both defects are reachable from untrusted .torrent files or peer-supplied metadata with a 16 MiB size cap, making remote exploitation feasible.

Affected products

anacrolix torrent 1.61.0 and earlier

Identifiers

GHSA-2wrx-84qj-4pcg
GO-2026-6894

Timeline

2026-09-11: disclosed
2026-09-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.