CVE-2026-57081: Net::BitTorrent DoS Vulnerability

CVE-2026-57081 Overview

CVE-2026-57081 is a memory exhaustion vulnerability in the Net::BitTorrent Perl module through version 2.0.1. The bdecode routine recurses once per nested list or dictionary level with no depth cap. Each recursive call receives the remaining buffer by value, so every live frame retains its own copy of the shrinking buffer. This produces O(N²) memory growth for an N-deep input.

The decoder processes every untrusted bencode source, including .torrent files, BEP09 metadata from peers, DHT messages, and tracker responses. A crafted input of roughly 150,000 nested lists (about 150 KB on the wire) drives multi-gigabyte peak memory and terminates the client.

Critical Impact
A single short message from any peer, one crafted .torrent file, or a malicious magnet link can exhaust host memory and crash the BitTorrent client remotely without authentication.

Affected Products

Net::BitTorrent for Perl, versions through 2.0.1
Applications embedding the Net::BitTorrent Perl module
BitTorrent clients and tooling that call bdecode on untrusted input

Discovery Timeline

2026-06-30 - CVE CVE-2026-57081 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-57081

Vulnerability Analysis

The flaw is an uncontrolled resource consumption issue [CWE-400] in the bencode decoder. Bencode is the serialization format used across the BitTorrent protocol for .torrent files, DHT traffic, tracker responses, and metadata exchange (BEP09). The Perl implementation in Net::BitTorrent decodes lists and dictionaries through direct recursion.

Two compounding defects drive the impact. First, the decoder enforces no maximum nesting depth, so an attacker controls the recursion count purely through input structure. Second, the list and dictionary branches capture the full remaining input buffer, and Perl passes those scalars by value into each recursive call. Each of the N active frames keeps a copy of the tail buffer, yielding quadratic memory usage.

An input of roughly 150,000 nested list openings, only about 150 KB on the wire, expands into multi-gigabyte resident memory. The operating system terminates the process or the host swaps to unusability.

Root Cause

The root cause is the combination of unbounded recursion depth and by-value buffer capture in the list and dictionary decoding paths of bdecode. Neither a depth guard nor a reference or index-based parse strategy is in place. Any attacker-supplied bencoded blob is trusted to be well-formed and shallow.

Attack Vector

Exploitation requires no authentication and no user interaction beyond normal client operation. An attacker can deliver the malicious payload as a .torrent file, a magnet link resolved via BEP09 metadata exchange, a DHT query or response, or a tracker response. Any peer on the swarm can send a single crafted message and terminate the target client.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-mv44-v82p-89xv for the maintainer's technical description.

Detection Methods for CVE-2026-57081

Indicators of Compromise

Perl processes hosting Net::BitTorrent showing sudden resident memory spikes into the multi-gigabyte range followed by termination or out-of-memory kills.
Repeated client crashes correlated with inbound peer messages, tracker responses, or newly loaded .torrent files or magnet links.
Kernel oom-killer events targeting Perl interpreters running BitTorrent workloads.

Detection Strategies

Inspect bencoded payloads at ingress and flag inputs whose nesting depth of l or d tokens exceeds a low threshold, for example 100 levels.
Monitor process memory growth rate for Perl workers and alert when allocations exceed a defined ceiling within seconds.
Log and review .torrent file sources, magnet link origins, and peer identifiers preceding client crashes.

Monitoring Recommendations

Enable resource accounting (ulimit -v, systemdMemoryMax) on hosts running Net::BitTorrent and forward OOM events to a central log store.
Capture packet metadata for DHT and tracker traffic to correlate crash events with specific peers or trackers.
Track loaded Perl module versions across the fleet to identify hosts still running Net::BitTorrent 2.0.1 or earlier.

How to Mitigate CVE-2026-57081

Immediate Actions Required

Inventory all systems running the Net::BitTorrent Perl module and identify versions 2.0.1 and earlier.
Restrict inbound peer, DHT, and tracker traffic to the affected hosts until a fixed version is deployed.
Refuse to load .torrent files and magnet links from untrusted sources during the remediation window.

Patch Information

Refer to the GitHub Security Advisory GHSA-mv44-v82p-89xv for the maintainer's fix status and upgrade instructions. Upgrade to a released version that adds a recursion depth cap and switches the decoder away from by-value buffer capture.

Workarounds

Wrap bdecode calls with a pre-parse depth check that rejects inputs containing more than a small number of consecutive l or d tokens.
Apply per-process memory limits using ulimit -v or systemdMemoryMax so a single crafted message cannot exhaust host memory.
Disable DHT and PEX features and restrict peer connections to trusted trackers until patched.

bash

# Example per-process memory cap for a Perl worker running Net::BitTorrent
systemd-run --scope -p MemoryMax=512M -p MemorySwapMax=0 \
    perl /opt/app/bt-worker.pl