{"id":"CVE-2026-123096","kind":"vulnerability","aliases":["CVE-2026-123096"],"related":[],"title":"anacrolix/torrent: unbounded tracker responses let malicious trackers crash clients","description":"anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.","summary":"The anacrolix/torrent Go library reads HTTP tracker announce and scrape responses into memory without a size limit. A malicious tracker can return huge or gzip-compressed responses to exhaust the client process's memory and crash it.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bittorrent","go","package","torrent-clients"],"not_affected_if":["no-untrusted-torrents","udp-trackers-only"],"how_to_check":"- Check whether the application imports `github.com/anacrolix/torrent` at a version through `1.61.0` in `go.mod`.\n- Check whether the code calls `Client.Announce` or `Client.Scrape` against HTTP trackers taken from untrusted torrent files or magnet links.","fix":"- `github.com/anacrolix/torrent`: a patch is linked in the sources, but the fixed version is not stated.","status":"open","published_at":"2026-11-05T16:17:46+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","triaged_at":"2026-11-05T16:41:37+00:00","updated_at":"2026-11-05T16:41:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T16:41:37Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/anacrolix/torrent`: a patch is linked in the sources, but the fixed version is not stated.","reach":"internet","title":"anacrolix/torrent: unbounded tracker responses let malicious trackers crash clients","impact":"medium","summary":"The anacrolix/torrent Go library reads HTTP tracker announce and scrape responses into memory without a size limit. A malicious tracker can return huge or gzip-compressed responses to exhaust the client process's memory and crash it.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","bittorrent","torrent-clients"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"a malicious tracker crashes the client process through memory exhaustion","analyst_note":"","how_to_check":"- Check whether the application imports `github.com/anacrolix/torrent` at a version through `1.61.0` in `go.mod`.\n- Check whether the code calls `Client.Announce` or `Client.Scrape` against HTTP trackers taken from untrusted torrent files or magnet links.","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-torrents","udp-trackers-only"],"who_is_affected":"Applications that use anacrolix/torrent to download torrents or magnet links from users or other untrusted sources are exposed, because a tracker named in those links controls the responses. Applications that only use UDP trackers, or that never accept untrusted torrent or magnet input, are less likely to be affected, but the sources do not say which tracker transports are covered.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001123,"input_tokens":4305,"output_tokens":1384,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123096':12A,15A '-2026':11A,14A '1.61.0':61C 'allow':72C 'anacrolix/torrent':1A,23B,59C 'announc':29B,101C 'attack':82C 'bittorr':16B 'buffer':109C 'client':9A,21B,53B,77C 'client.announce':106C 'client.scrape':108C 'compress':48B,100C 'contain':62C 'control':83C 'crash':8A,58B,76C 'cve':10A,13A 'exhaust':51B,65C,112C 'file':90C 'go':17B,24B 'gzip':47B,99C 'gzip-compress':46B,98C 'http':27B,85C 'huge':44B,96C 'let':5A 'librari':25B 'limit':38B,111C 'link':93C 'magnet':92C 'malici':6A,40B,73C 'memori':34B,56B,64C,114C 'packag':18B,70C 'process':54B,113C 'read':26B 'respons':4A,32B,49B,81C,104C 'return':43B,79C,95C 'scrape':31B,103C 'size':37B 'torrent':20B,89C 'torrent-cli':19B 'tracker':3A,7A,28B,41B,74C,86C 'tracker/http':69C 'unbound':2A,80C 'vulner':66C 'without':35B,110C","nicknames":[],"mitigations":[],"who_affected":"Applications that use anacrolix/torrent to download torrents or magnet links from users or other untrusted sources are exposed, because a tracker named in those links controls the responses. Applications that only use UDP trackers, or that never accept untrusted torrent or magnet input, are less likely to be affected, but the sources do not say which tracker transports are covered.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bittorrent","go","high","package","torrentclients"],"campaign_type":null,"first_public_at":"2026-11-05T16:17:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123096","severity":null,"published_at":"2026-11-05T16:17:46+00:00","modified_at":"2026-11-05T16:17:46+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","fetched_at":"2026-11-05T16:40:02+00:00","note":null}],"documents":[{"id":77645,"url":"https://github.com/anacrolix/torrent/commit/92ad51490479bb8b94720f964b1c67e5a1d68faa","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77646,"url":"https://www.vulncheck.com/advisories/anacrolix-torrent-through-1.61.0-memory-exhaustion-via-unbounded-http-tracker-response","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}