Uncontrolled recursion and O(N²) memory exhaustion in Net::BitTorrent (CVE-2026-57081)

The bencode decoder in Net::BitTorrent recurses once per nested list or dictionary level with no depth cap, and each recursive frame retains its own copy of the remaining buffer, resulting in O(N²) peak memory consumption for deeply nested input. An attacker can send approximately 150 KB of crafted nested bencoded data from any peer, or supply a malicious .torrent file or magnet link, to exhaust process memory and terminate the client via OOM kill - a cheap remote denial of service. Affected versions: - <= v2.0.1 We recommend updating to: v2.1.0. CVSS 7.5 · our assessment: this_week Reference: https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-mv44-v82p-89xv Details: https://vuln.today/cve/CVE-2026-57081