EUVD-2026-40289
GHSA-h9mr-rh28-v9r2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote peer (AV:N/PR:N/UI:N) trivially triggers unbounded buffering (AC:L) for an availability-only memory-exhaustion DoS (C:N/I:N/A:H), no scope change.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix.
The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the decoder waits until the buffer holds the full message before processing it, so the buffer grows without limit.
Peer connections are unauthenticated, so any peer in the swarm exhausts the downloading process's memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.
AnalysisAI
Remote memory exhaustion in the Net::BitTorrent Perl module (all versions through 2.0.1) lets any unauthenticated peer in a torrent swarm crash the downloading process by abusing the peer-wire protocol's length-prefix framing. Because the decoder buffers an entire announced message before processing and trusts an attacker-supplied length prefix of up to ~4 GiB, a single malicious peer can drive the victim's memory toward exhaustion. There is no public exploit identified at time of analysis and no CISA KEV listing, but the attack is trivial and requires no authentication; EPSS data was not provided.
Technical ContextAI
Net::BitTorrent implements the BitTorrent peer-wire protocol in pure Perl. In that protocol each message is framed with a 4-byte big-endian length prefix followed by the message body. The flaw is in _process_messages, which trusts the peer-supplied 4-byte length prefix with no upper bound, combined with receive_data, which appends every inbound byte to an input buffer and waits until the full announced message has arrived before decoding it. This is a textbook CWE-770 (Allocation of Resources Without Limits or Throttling): a peer can announce a length of up to ~4 GiB and stream bytes, causing the input buffer to grow unbounded. The CPE cpe:2.3:a:sanko:net::bittorrent identifies the affected component as the 'sanko' Net::BitTorrent distribution on CPAN. Notably, the largest legitimate peer-wire message is a 16 KiB piece block, so any announced length materially above 16 KiB is anomalous and could be rejected by a sane cap.
RemediationAI
No vendor-released patched version is identified in the available data; the only fix reference is the GitHub Security Advisory GHSA-7jr6-2jf4-6qc4 (https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-7jr6-2jf4-6qc4), so consult it for the fixed release and upgrade beyond 2.0.1 once published. As a compensating control, enforce a sane upper bound on the peer-wire length prefix in _process_messages - reject or disconnect any peer announcing a message length above the 16 KiB maximum legitimate piece-block size (plus small protocol headroom), which is the cleanest mitigation since no legitimate message exceeds that; the trade-off is a local code patch until an upstream release lands. Additionally, cap the per-connection input buffer in receive_data and drop connections that exceed it, and restrict or rate-limit inbound peer connections (e.g., firewall the listening port to trusted peers) - at the cost of reduced swarm connectivity and download performance.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today