anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
anacrolix torrent unaffected
Version Status Constraints
0 affected ≤ 1.61.0

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Torrentflux Project Subscribe
Torrentflux Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/anacrolix/torrent cve-icon
https://github.com/anacrolix/torrent/blob/v1.61.0/tracker/http/http.go#L114-L126 cve-icon
https://github.com/anacrolix/torrent/commit/92ad51490479bb8b94720f964b1c67e5a1d68faa cve-icon
https://github.com/anacrolix/torrent/pull/1143 cve-icon
https://www.vulncheck.com/advisories/anacrolix-torrent-through-1.61.0-memory-exhaustion-via-unbounded-http-tracker-response cve-icon
History

Thu, 05 Nov 2026 15:30:00 +0000

Type Values Removed Values Added
Description anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.
Title anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response
First Time appeared Torrentflux Project
Torrentflux Project torrentflux
Weaknesses CWE-770
CPEs cpe:2.3:a:torrentflux_project:torrentflux:*:*:*:*:*:*:*:*
Vendors & Products Torrentflux Project
Torrentflux Project torrentflux
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-05T15:11:50.578Z

Reserved: 2026-11-05T12:22:13.477Z

Link: CVE-2026-123096

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses