CVE-2026-57080: Net::BitTorrent DoS Vulnerability

CVE-2026-57080 Overview

CVE-2026-57080 is a memory exhaustion vulnerability affecting Net::BitTorrent versions through 2.0.1 for Perl. The flaw resides in the peer-wire protocol handler, which trusts a 4-byte length prefix sent by any connected peer without enforcing an upper bound. A remote peer can announce a message length of approximately 4 GiB and slowly stream bytes, forcing the receiver to buffer data until memory is exhausted. Peer connections are unauthenticated, so any participant in a swarm can trigger the condition. The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
A single malicious peer can exhaust the host process memory of any client running Net::BitTorrent ≤ 2.0.1, causing denial of service on downloading nodes.

Affected Products

Net::BitTorrent Perl module versions up to and including 2.0.1
Applications embedding Net::BitTorrent as a torrent client library
Automated systems and daemons that participate in BitTorrent swarms using this module

Discovery Timeline

2026-06-30 - CVE-2026-57080 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-57080

Vulnerability Analysis

The defect resides in the peer-wire framing logic of Net::BitTorrent. The _process_messages routine reads a 4-byte length prefix from each connected peer and uses that value to determine when a complete message has arrived. The implementation places no upper bound on the declared length, while receive_data appends every inbound byte to the input buffer as it arrives.

A malicious peer declares a length prefix approaching 4 GiB and then drips bytes onto the socket. The decoder holds all received bytes in memory, waiting for the full message before processing. The buffer grows unbounded until the Perl process exhausts available memory and the operating system terminates it or thrashes.

The largest legitimate BitTorrent peer-wire message is a 16 KiB piece block. Any announced length far above that threshold is anomalous and should be rejected before allocation.

Root Cause

The root cause is missing input validation on the peer-wire length prefix. The decoder treats the attacker-controlled 4-byte field as authoritative and accumulates buffered bytes indefinitely. No sanity check compares the announced length against the protocol's legitimate maximum message size.

Attack Vector

Exploitation requires only the ability to open a TCP connection to a target Net::BitTorrent client and complete the standard peer handshake. BitTorrent peers are unauthenticated by design, so any peer discovered through a tracker or DHT can send a crafted length prefix and stream bytes at a low rate. No user interaction or credentials are required. Multiple concurrent malicious peers amplify the effect.

See the GitHub Security Advisory GHSA-7jr6-2jf4-6qc4 for the maintainer's technical description.

Detection Methods for CVE-2026-57080

Indicators of Compromise

Perl processes running Net::BitTorrent showing rapid, sustained resident set size (RSS) growth without corresponding download progress
TCP peers sending length prefixes larger than 0x00004000 (16 KiB) after a valid BitTorrent handshake
Out-of-memory (OOM) killer events terminating Perl processes on hosts participating in swarms
Long-lived peer connections with high inbound byte counts but no completed piece messages

Detection Strategies

Inspect peer-wire traffic on port ranges used by BitTorrent clients and alert on length prefixes exceeding 16 KiB plus a small protocol overhead
Monitor process memory ceilings for services embedding Net::BitTorrent and alert on unbounded growth
Correlate OOM kernel messages with active BitTorrent listener processes in host telemetry

Monitoring Recommendations

Baseline normal memory usage for torrent client processes and alert on deviation beyond expected working set
Log inbound peer connection metadata including declared message sizes for post-incident analysis
Track connections that transfer bytes continuously without producing valid piece completion events

How to Mitigate CVE-2026-57080

Immediate Actions Required

Inventory all hosts running Perl applications that depend on Net::BitTorrent and identify installed versions
Restrict inbound connections to BitTorrent listeners using host firewall rules where full patching is not immediately possible
Enforce per-process memory limits using ulimit, systemd MemoryMax, or cgroups to contain exhaustion attempts

Patch Information

At time of publication, refer to the upstream project at Net-BitTorrent.pm on GitHub and the GHSA-7jr6-2jf4-6qc4 advisory for fixed release information. Upgrade beyond version 2.0.1 once a patched release is available.

Workarounds

Patch the local copy of _process_messages to reject any length prefix greater than 2**14 + 13 bytes, covering the maximum piece block plus header overhead
Add a hard cap to receive_data so the input buffer is truncated and the peer disconnected when accumulated bytes exceed the legitimate maximum message size
Run torrent workloads inside a resource-constrained container to limit blast radius while a code fix is prepared

bash

# Constrain a Perl torrent daemon under systemd to cap memory usage
# /etc/systemd/system/nbt-daemon.service.d/limits.conf
[Service]
MemoryMax=512M
MemoryHigh=400M
TasksMax=256