EUVD-2026-40289
GHSA-h9mr-rh28-v9r2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin victim's torrent swarm as peer
-
DeliveryComplete peer-wire handshake
-
ExploitAnnounce ~4 GiB message length prefix
-
ExecutionStream bytes filling input buffer
-
ImpactExhaust process memory (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the victim is running Net::BitTorrent (≤2.0.1) and is connected to the attacker as a peer in a swarm - peer connections are unauthenticated, so any peer the victim connects to or accepts can trigger it. The attacker must be able to complete a peer-wire handshake and send a message with a length prefix far above the 16 KiB legitimate maximum (up to ~4 GiB). The limiting factor is reachability: the target must actively participate in a torrent swarm that includes the attacker's peer, and impact is denial of service only (memory exhaustion), with no path to code execution or data disclosure. No special non-default configuration, user interaction, or authentication is needed. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 HIGH) is internally consistent with the description: network reachable, low complexity, no privileges, no user interaction, and an availability-only impact - there is no confidentiality or integrity exposure, only denial of service via memory exhaustion. No EPSS score, KEV status, SSVC decision, or POC was supplied, so probabilistic and real-world-exploitation signals are absent rather than low. The realistic risk is bounded by deployment footprint: Net::BitTorrent is a niche pure-Perl module, so while exploitation is technically easy and unauthenticated, the population of exposed production systems is small. This is a genuine, easy-to-trigger availability bug rather than a high-severity scoring artifact, but its practical priority is moderated by the obscurity of the affected product and the DoS-only impact. No conflicting signals were observed between the CVSS vector and the description. |
| Exploit ScenarioDerived | An attacker joins the target's torrent swarm as an ordinary unauthenticated peer, completes the handshake, and sends a peer-wire message header announcing a length prefix near 4 GiB, then slowly streams bytes. The victim's Net::BitTorrent process buffers all incoming bytes while waiting for the full message, consuming memory until it is exhausted and the process crashes or the host degrades. No public exploit code is identified at time of analysis, but the low attack complexity makes weaponization trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 30, 2026
Remote memory exhaustion in the Net::BitTorrent Perl module (all versions through 2.0.1) lets any unauthenticated peer in a torrent swarm crash the downloading process by abusing the peer-wire protocol's length-prefix framing. Because the decoder buffers an entire announced message before processing and trusts an attacker-supplied length prefix of up to ~4 GiB, a single malicious peer can drive the victim's memory toward exhaustion. There is no public exploit identified at time of analysis and no CISA KEV listing, but the attack is trivial and requires no authentication; EPSS data was not provided.
RemediationAI
No vendor-released patched version is identified in the available data; the only fix reference is the GitHub Security Advisory GHSA-7jr6-2jf4-6qc4 (https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-7jr6-2jf4-6qc4), so consult it for the fixed release and upgrade beyond 2.0.1 once published. As a compensating control, enforce a sane upper bound on the peer-wire length prefix in _process_messages - reject or disconnect any peer announcing a message length above the 16 KiB maximum legitimate piece-block size (plus small protocol headroom), which is the cleanest mitigation since no legitimate message exceeds that; the trade-off is a local code patch until an upstream release lands. Additionally, cap the per-connection input buffer in receive_data and drop connections that exceed it, and restrict or rate-limit inbound peer connections (e.g., firewall the listening port to trusted peers) - at the cost of reduced swarm connectivity and download performance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Net::BitTorrent implements the BitTorrent peer-wire protocol in pure Perl. In that protocol each message is framed with a 4-byte big-endian length prefix followed by the message body. The flaw is in _process_messages, which trusts the peer-supplied 4-byte length prefix with no upper bound, combined with receive_data, which appends every inbound byte to an input buffer and waits until the full announced message has arrived before decoding it. This is a textbook CWE-770 (Allocation of Resources Without Limits or Throttling): a peer can announce a length of up to ~4 GiB and stream bytes, causing the input buffer to grow unbounded. The CPE cpe:2.3:a:sanko:net::bittorrent identifies the affected component as the 'sanko' Net::BitTorrent distribution on CPAN. Notably, the largest legitimate peer-wire message is a 16 KiB piece block, so any announced length materially above 16 KiB is anomalous and could be rejected by a sane cap.
Know when Net gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote peer (AV:N/PR:N/UI:N) trivially triggers unbounded buffering (AC:L) for an availability-only memory-exhaustion DoS (C:N/I:N/A:H), no scope change.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
2DescriptionCVE.org
Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix.
The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the decoder waits until the buffer holds the full message before processing it, so the buffer grows without limit.
Peer connections are unauthenticated, so any peer in the swarm exhausts the downloading process's memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.
Executive ViewAI
The Net::BitTorrent Perl module (all versions through 2.0.1) is vulnerable to remote memory exhaustion attacks from unauthenticated adversaries who can crash downloading processes through malformed peer-wire protocol messages. No public exploit identified at time of analysis, but the attack method is trivial to execute against any organization using this module for torrent-based distribution. With no vendor patch currently available, immediate mitigation through isolation or module replacement is critical to prevent operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Isolate systems running Net::BitTorrent from untrusted torrent swarms via network segmentation and firewall rules; (2) Deploy memory consumption monitoring with automated process restarts at 85% utilization threshold; (3) Restrict peer discovery and connectivity to internal/whitelisted networks only; (4) Evaluate discontinuing Net::BitTorrent and transitioning to alternative, actively maintained file distribution mechanisms if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Remote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compre
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Exploit-DB