CVE-2026-71832: Aria2 Divide By Zero DOS Vulnerability

CVE-2026-71832 Overview

CVE-2026-71832 is a divide-by-zero vulnerability affecting Aria2 version 1.37.0 and earlier. The flaw resides in src/bittorrent_helper.cc, the helper responsible for parsing BitTorrent metadata. A remote attacker can trigger the arithmetic fault by supplying a crafted torrent or metadata payload, causing the Aria2 process to terminate. The result is a Denial of Service (DoS) condition against any host or service relying on Aria2 for BitTorrent downloads.

Critical Impact
Remote attackers can crash Aria2 processes by delivering malformed BitTorrent metadata, interrupting downloads and disrupting any automation or service that depends on Aria2.

Affected Products

Aria2 version 1.37.0
Aria2 versions prior to 1.37.0
Deployments using bittorrent_helper.cc for torrent parsing

Discovery Timeline

2026-08-24 - CVE-2026-71832 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-71832

Vulnerability Analysis

Aria2 is a lightweight, multi-protocol download utility that supports HTTP, FTP, SFTP, BitTorrent, and Metalink. The vulnerability sits inside src/bittorrent_helper.cc, which parses .torrent files and BitTorrent metadata dictionaries. During parsing, the code performs an arithmetic operation using a value derived from attacker-controlled input as a divisor. When that value equals zero, the CPU raises a division exception and the process terminates.

Because Aria2 often runs as a long-lived background service or download agent, a single malformed input aborts active downloads and any queued work in the same process. Repeated delivery of malicious metadata prevents the service from returning to a stable state, extending the outage. The issue is classified as a Denial of Service resource-availability flaw.

Root Cause

The root cause is missing input validation on numeric fields decoded from BitTorrent metadata before those fields are used as divisors. The parser does not enforce a non-zero constraint prior to the division, allowing untrusted values to reach an unchecked arithmetic operation. See GitHub Issue #2371 for the maintainer discussion.

Attack Vector

The attack vector is remote and requires no authentication when Aria2 accepts torrent input from untrusted sources. An attacker delivers a crafted .torrent file, magnet metadata, or peer-supplied dictionary that contains a zero value in the field used as a divisor. When Aria2 loads the payload, the process crashes. Common exploitation paths include hosted torrent trackers, RPC-exposed Aria2 instances, and download portals that ingest user-supplied torrent files.

No verified public exploit code is available. The vulnerability mechanism is described in the referenced GitHub Issue #2371.

Detection Methods for CVE-2026-71832

Indicators of Compromise

Unexpected termination of the aria2c process with a floating-point or arithmetic exception signal (SIGFPE) recorded in system logs.
Repeated crash-and-restart loops of Aria2 services shortly after ingesting new torrent metadata.
Inbound .torrent files or magnet payloads from untrusted sources containing anomalous zero-valued numeric fields.

Detection Strategies

Monitor for SIGFPE (signal 8) terminations of Aria2 processes in host telemetry and container runtime logs.
Correlate Aria2 process exits with recent torrent-file ingestion or Aria2 RPC calls such as aria2.addTorrent and aria2.addUri.
Baseline normal Aria2 uptime and alert on abnormal restart frequency across managed hosts.

Monitoring Recommendations

Enable process-exit and crash-dump collection on hosts running Aria2 to capture the faulting call site.
Log all torrent inputs and their source IPs when Aria2 is exposed over JSON-RPC or XML-RPC.
Alert when the Aria2 RPC endpoint is reachable from untrusted networks.

How to Mitigate CVE-2026-71832

Immediate Actions Required

Restrict access to the Aria2 RPC interface (default TCP 6800) to trusted management networks only.
Reject or sandbox .torrent files and magnet links sourced from untrusted users pending an upstream fix.
Run Aria2 under a process supervisor with rate-limited restart to prevent crash-loop amplification.

Patch Information

At the time of publication, no fixed release is identified in the NVD entry for CVE-2026-71832. Track upstream progress and any patch commits through GitHub Issue #2371 and upgrade to the first Aria2 release that references this issue in its changelog.

Workarounds

Disable BitTorrent functionality with --enable-dht=false and avoid loading .torrent files if BitTorrent is not required.
Run Aria2 in an isolated container with resource limits so a crash does not affect other services.
Front the RPC endpoint with an authenticated reverse proxy and enforce --rpc-secret with a strong token.

bash

# Configuration example: restrict Aria2 RPC and disable BitTorrent features
aria2c \
  --enable-rpc=true \
  --rpc-listen-all=false \
  --rpc-listen-port=6800 \
  --rpc-secret=REPLACE_WITH_STRONG_TOKEN \
  --rpc-allow-origin-all=false \
  --enable-dht=false \
  --enable-peer-exchange=false \
  --bt-enable-lpd=false