EUVD-2026-40290
GHSA-39fp-mc5w-p8hh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, low-complexity, unauthenticated, no-interaction trigger via any untrusted bencode source; impact is availability-only (crash), so C:N/I:N/A:H.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via deeply nested bencoded input.
bdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by value while the list and dictionary branches capture the whole remainder, so every live recursion frame keeps its own copy of the shrinking buffer (O(N^2) bytes for an N-deep input). The decoder runs on every untrusted bencode source: .torrent files, BEP09 metadata fetched from peers, DHT messages, and tracker responses.
A bencoded input of roughly 150,000 nested lists (about 150 KB on the wire) drives multi-gigabyte peak memory, so one short message from any peer, or one crafted .torrent file or magnet link, terminates the client.
AnalysisAI
Remote memory exhaustion in the Perl Net::BitTorrent library (all versions through 2.0.1) lets any peer or crafted file crash the client with a single small message. The bdecode parser recurses once per nesting level with no depth cap and copies the shrinking buffer by value at each list/dictionary frame, yielding O(N^2) memory so ~150 KB of deeply nested bencode drives multi-gigabyte peak usage. No public exploit identified at time of analysis; EPSS is low (0.26%, 18th percentile) and this is not on CISA KEV, but SSVC flags it as automatable with partial technical impact.
Technical ContextAI
Bencoding is BitTorrent's serialization format (RFC-style 'd...e' dictionaries, 'l...e' lists, integers, and length-prefixed strings) used across the ecosystem. The flaw is CWE-674 (Uncontrolled Recursion): Net::BitTorrent's bdecode routine descends one recursive call per nested list or dictionary with no maximum-depth guard. Critically, each recursive call receives the remaining input buffer by value while the list and dictionary branches capture the whole remainder, so every live stack frame retains its own copy of the still-large buffer - producing quadratic O(N^2) memory growth for an N-deep input rather than the linear cost a streaming parser would incur. The affected package is cpe:2.3:a:sanko:net::bittorrent, and the decoder sits on every untrusted intake path: .torrent files, BEP09 metadata exchanged with peers, DHT messages, and tracker responses.
RemediationAI
Vendor-released patch: upgrade to Net-BitTorrent v2.1.0 from CPAN, which adds a recursion depth cap to bdecode (see the changes at https://metacpan.org/release/SANKO/Net-BitTorrent-v2.1.0/changes and advisory GHSA-mv44-v82p-89xv). If you cannot upgrade immediately, wrap or pre-screen untrusted bencode before decoding: reject inputs whose nesting depth exceeds a small sane bound (a few hundred levels) or whose size is implausible for the context, and impose a per-process memory limit (e.g. ulimit -v / cgroup memory cap) so a triggered crash is contained rather than exhausting the host - the trade-off is that a hard memory cap may kill legitimate large-metadata transfers, and depth screening requires a safe pre-parser since the vulnerable decoder itself is the thing you must avoid invoking. Where feasible, restrict or firewall untrusted peer/DHT/tracker exposure until patched, accepting reduced connectivity.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today