CVE-2026-123096 · Package
NO FIX YET · SEE WHAT TO DO
The anacrolix/torrent Go library reads HTTP tracker announce and scrape responses into memory without a size limit. A malicious tracker can return huge or gzip-compressed responses to exhaust the client process's memory and crash it.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use anacrolix/torrent to download torrents or magnet links from users or other untrusted sources are exposed, because a tracker named in those links controls the responses. Applications that only use UDP trackers, or that never accept untrusted torrent or magnet input, are less likely to be affected, but the sources do not say which tracker transports are covered.
Not affected if no-untrusted-torrents, udp-trackers-only
Who cares bittorrent, go, torrent-clients
github.com/anacrolix/torrent at a version through 1.61.0 in go.mod.Client.Announce or Client.Scrape against HTTP trackers taken from untrusted torrent files or magnet links.github.com/anacrolix/torrent: a patch is linked in the sources, but the fixed version is not stated.anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.