CVE-2026-57080 Details

A denial-of-service vulnerability has been identified in Net::BitTorrent versions through 2.0.1 for Perl. The issue arises from the peer-wire message framing, which improperly trusts the 4-byte length prefix sent by connected peers, allowing for remote memory exhaustion. The '_process_messages' function reads the length prefix without any upper limit, while 'receive_data' continuously appends incoming bytes to the input buffer. This unbounded buffering can be exploited by a peer that announces a length prefix of up to approximately 4 GiB, leading to excessive memory consumption. Since peer connections are unauthenticated, any peer in the swarm can exploit this vulnerability, causing the downloading process to run out of memory. The vulnerability is particularly concerning because it can be easily amplified across multiple connections, creating a significant denial-of-service impact on active downloads.

It is recommended to modify the '_process_messages' function to reject length prefixes above a reasonable maximum, such as 1 MiB, and disconnect the peer instead of allowing unbounded buffering.