Resource exhaustion in Anacrolix Torrent
CVE-2026-123096
anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.
Published .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/anacrolix/torrent (product)
- github.com/anacrolix/torrent/blob/v1.61.0/tracker/http/http.go (technical-description)
- github.com/anacrolix/torrent/commit/92ad51490479bb8b94720f964b1c67e5a1d68faa (patch)
- github.com/anacrolix/torrent/pull/1143 (issue-tracking, patch)
- VulnCheck Advisory: anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response (third-party-advisory)
Frequently asked questions
- What is CVE-2026-123096?
- CVE-2026-123096 is a medium-severity vulnerability in Anacrolix Torrent, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 6.5/10. Published 2026-11-05.
- How severe is CVE-2026-123096?
- Medium severity. CVSS v3 base score is 6.5 out of 10.