EUVD-2026-40290
GHSA-39fp-mc5w-p8hh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect as peer or deliver crafted .torrent/magnet
-
DeliverySend ~150KB deeply-nested bencoded payload
-
Exploitbdecode recurses without depth cap
-
ExecutionQuadratic per-frame buffer copies
-
PersistMulti-gigabyte memory exhaustion
-
ImpactClient OOM crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Net::BitTorrent, because the vulnerable bdecode routine runs on every untrusted bencode source (.torrent files, BEP09 peer metadata, DHT messages, tracker responses) with no depth cap. The only prerequisite is that the target process actually decode attacker-supplied bencode, which is the normal operating mode for any client participating in swarms, DHT, or opening torrents/magnet links. Limiting factors: impact is confined to availability (crash/DoS) with no code execution or data disclosure, and a client not exposed to untrusted peers or files (e.g. only decoding locally trusted torrents) is not reachable; effective payloads require deep nesting (~150k levels) rather than merely large size. |
| Impact | Signals are internally consistent and point to a real but bounded availability threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) correctly reflects remote, low-complexity, unauthenticated, no-interaction denial of service with no confidentiality or integrity impact - a pure crash/DoS, so despite the 'High' severity there is no data exposure (the input 'Information Disclosure' tag is misleading and contradicted by C:N/I:N). SSVC agrees: exploitation is currently 'none' (no observed attacks), yet 'automatable: yes' and 'technical impact: partial' - meaning it is trivially scriptable against many targets even though impact is limited to availability. EPSS is low at 0.26% and it is absent from CISA KEV, consistent with no in-the-wild exploitation to date. Net effect: high reliability and low effort to trigger a crash, but the ceiling is DoS only; priority should be moderate - patch promptly on exposed/peer-facing deployments, lower urgency for isolated ones. |
| Exploit ScenarioDerived | An attacker connects to the target client as an ordinary peer (or gets it to open a crafted .torrent file or magnet link) and sends a single ~150 KB bencoded payload of roughly 150,000 nested lists. The decoder's quadratic buffer copying spikes to multiple gigabytes and the client is OOM-killed or crashes; because the vector is network, unauthenticated, and low-complexity, the attack is a one-shot message requiring no user interaction beyond normal peer communication. No public proof-of-concept has been identified, but the technique is fully described and trivially automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Remote memory exhaustion in the Perl Net::BitTorrent library (all versions through 2.0.1) lets any peer or crafted file crash the client with a single small message. The bdecode parser recurses once per nesting level with no depth cap and copies the shrinking buffer by value at each list/dictionary frame, yielding O(N^2) memory so ~150 KB of deeply nested bencode drives multi-gigabyte peak usage. No public exploit identified at time of analysis; EPSS is low (0.26%, 18th percentile) and this is not on CISA KEV, but SSVC flags it as automatable with partial technical impact.
RemediationAI
Vendor-released patch: upgrade to Net-BitTorrent v2.1.0 from CPAN, which adds a recursion depth cap to bdecode (see the changes at https://metacpan.org/release/SANKO/Net-BitTorrent-v2.1.0/changes and advisory GHSA-mv44-v82p-89xv). If you cannot upgrade immediately, wrap or pre-screen untrusted bencode before decoding: reject inputs whose nesting depth exceeds a small sane bound (a few hundred levels) or whose size is implausible for the context, and impose a per-process memory limit (e.g. ulimit -v / cgroup memory cap) so a triggered crash is contained rather than exhausting the host - the trade-off is that a hard memory cap may kill legitimate large-metadata transfers, and depth screening requires a safe pre-parser since the vulnerable decoder itself is the thing you must avoid invoking. Where feasible, restrict or firewall untrusted peer/DHT/tracker exposure until patched, accepting reduced connectivity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Bencoding is BitTorrent's serialization format (RFC-style 'd...e' dictionaries, 'l...e' lists, integers, and length-prefixed strings) used across the ecosystem. The flaw is CWE-674 (Uncontrolled Recursion): Net::BitTorrent's bdecode routine descends one recursive call per nested list or dictionary with no maximum-depth guard. Critically, each recursive call receives the remaining input buffer by value while the list and dictionary branches capture the whole remainder, so every live stack frame retains its own copy of the still-large buffer - producing quadratic O(N^2) memory growth for an N-deep input rather than the linear cost a streaming parser would incur. The affected package is cpe:2.3:a:sanko:net::bittorrent, and the decoder sits on every untrusted intake path: .torrent files, BEP09 metadata exchanged with peers, DHT messages, and tracker responses.
Know when Net gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, low-complexity, unauthenticated, no-interaction trigger via any untrusted bencode source; impact is availability-only (crash), so C:N/I:N/A:H.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
2DescriptionCVE.org
Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via deeply nested bencoded input.
bdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by value while the list and dictionary branches capture the whole remainder, so every live recursion frame keeps its own copy of the shrinking buffer (O(N^2) bytes for an N-deep input). The decoder runs on every untrusted bencode source: .torrent files, BEP09 metadata fetched from peers, DHT messages, and tracker responses.
A bencoded input of roughly 150,000 nested lists (about 150 KB on the wire) drives multi-gigabyte peak memory, so one short message from any peer, or one crafted .torrent file or magnet link, terminates the client.
Executive ViewAI
Perl Net::BitTorrent library (all versions through 2.0.1) contains a remote vulnerability enabling any peer to trigger memory exhaustion and service crash via a single crafted message. Organizations using this library for BitTorrent operations face availability risk and require immediate asset discovery and mitigation deployment.
No vendor-released patch identified at time of analysis. Implement message-size limits and maximum bencode nesting-depth validation at application layer; deploy runtime memory monitoring with restart triggers; restrict peer connections to whitelisted or reputation-scored sources; rate-limit bencode message processing; establish logging to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Remote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compre
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Exploit-DB