{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123096", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T12:22:13.477Z", "datePublished": "2026-11-05T15:11:50.578Z", "dateUpdated": "2026-11-05T15:11:50.578Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T15:11:50.578Z"}, "datePublic": "2026-10-19T00:00:00.000Z", "title": "anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response", "descriptions": [{"lang": "en", "value": "anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Allocation of Resources Without Limits or Throttling", "cweId": "CWE-770", "type": "CWE"}]}], "affected": [{"vendor": "anacrolix", "product": "torrent", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "1.61.0", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/anacrolix/torrent", "collectionURL": "https://pkg.go.dev", "repo": "https://github.com/anacrolix/torrent"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:torrentflux_project:torrentflux:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.61.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/anacrolix/torrent/pull/1143", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/anacrolix/torrent/commit/92ad51490479bb8b94720f964b1c67e5a1d68faa", "tags": ["patch"]}, {"url": "https://github.com/anacrolix/torrent/blob/v1.61.0/tracker/http/http.go#L114-L126", "tags": ["technical-description"]}, {"url": "https://github.com/anacrolix/torrent", "tags": ["product"]}, {"name": "VulnCheck Advisory: anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/anacrolix-torrent-through-1.61.0-memory-exhaustion-via-unbounded-http-tracker-response"}], "credits": [{"lang": "en", "value": "Reload3d", "type": "finder"}, {"lang": "en", "value": "Matt Joiner (anacrolix)", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/anacrolix/torrent", "product": "torrent", "repo": "https://github.com/anacrolix/torrent", "vendor": "anacrolix", "versions": [{"lessThanOrEqual": "1.61.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory."}], "id": "CVE-2026-123096", "lastModified": "2026-11-05T16:17:46.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-05T16:17:46.760", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/anacrolix/torrent"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/anacrolix/torrent/blob/v1.61.0/tracker/http/http.go#L114-L126"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/anacrolix/torrent/commit/92ad51490479bb8b94720f964b1c67e5a1d68faa"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/anacrolix/torrent/pull/1143"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/anacrolix-torrent-through-1.61.0-memory-exhaustion-via-unbounded-http-tracker-response"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "github.com/anacrolix/torrent: anacrolix/torrent: Denial of Service via unbounded HTTP tracker responses", "id": "2567460", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567460"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in anacrolix/torrent. A remote attacker controlling a malicious HTTP tracker can cause a Denial of Service (DoS) by returning excessively large or compressed responses to announce or scrape requests. Because the client buffers incoming HTTP responses without size restrictions, processing these payloads exhausts process memory and crashes the client application."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123096", "public_date": "2026-11-05T15:11:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123096\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123096\nhttps://github.com/anacrolix/torrent\nhttps://github.com/anacrolix/torrent/blob/v1.61.0/tracker/http/http.go#L114-L126\nhttps://github.com/anacrolix/torrent/commit/92ad51490479bb8b94720f964b1c67e5a1d68faa\nhttps://github.com/anacrolix/torrent/pull/1143\nhttps://www.vulncheck.com/advisories/anacrolix-torrent-through-1.61.0-memory-exhaustion-via-unbounded-http-tracker-response"], "statement": "This vulnerability is rated as Moderate for Red Hat because exploitation depends on user interaction to connect to an adversarial tracker, restricting the impact to a denial of service of the affected client process. Red Hat Enterprise Linux and core enterprise offerings do not distribute or execute BitTorrent client workflows by default. Successful triggering leads exclusively to process termination without risking confidential information disclosure or unauthorized data modification.", "threat_severity": "Moderate"}