CVE-2026-57080
Last modified
CVE-2026-57080 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the decoder waits until the buffer holds the full message before processing it, so the buffer grows without limit. Peer connections are unauthenticated, so any peer in the swarm exhausts the downloading process's memory. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the decoder waits until the buffer holds the full message before processing it, so the buffer grows without limit. Peer connections are unauthenticated, so any peer in the swarm exhausts the downloading process's memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| SANKO | Net::BitTorrent | <= 2.0.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-57080?
How severe is CVE-2026-57080?
How do I fix CVE-2026-57080?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-57074XML::Bare versions through 0.53 for Perl have an unbounded c…9.1
- CVE-2026-57075YAML::Syck versions before 1.47 for Perl allow an out-of-bou…9.1
- CVE-2026-57076YAML::Syck versions before 1.47 for Perl allow a heap use-af…7.8
- CVE-2026-57077YAML::Syck versions before 1.47 for Perl allow an out-of-bou…7.7
- CVE-2026-57079Net::BitTorrent versions before 2.1.0 for Perl write files o…5.3
- CVE-2026-5708Unsanitized control of user-modifiable attributes in the ses…8.8
- CVE-2026-57081Net::BitTorrent versions through 2.1.0 for Perl allow remote…7.5
- CVE-2026-57082Net::BitTorrent versions before 2.1.0 for Perl generate the …5.9
- CVE-2026-57083Use of uninitialized resource in Microsoft Windows Codecs Li…5.5
- CVE-2026-57084Use of uninitialized resource in Windows File Explorer allow…5.5
- CVE-2026-57085Out-of-bounds read in Windows Print Spooler Components allow…3.3
- CVE-2026-57087Heap-based buffer overflow in Microsoft Windows Media Founda…7.8
Are you affected by CVE-2026-57080?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST