{"id":"CVE-2026-123096","title":"anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response","summary":"anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-770"],"vendor":"anacrolix","product":"torrent","affected":["torrent <= 1.61.0"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T15:11:50.578Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123096","references":[{"url":"https://github.com/anacrolix/torrent/pull/1143"},{"url":"https://github.com/anacrolix/torrent/commit/92ad51490479bb8b94720f964b1c67e5a1d68faa"},{"url":"https://github.com/anacrolix/torrent/blob/v1.61.0/tracker/http/http.go#L114-L126"},{"url":"https://github.com/anacrolix/torrent"},{"url":"https://www.vulncheck.com/advisories/anacrolix-torrent-through-1.61.0-memory-exhaustion-via-unbounded-http-tracker-response","label":"VulnCheck Advisory: anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.894Z","epss":0.00256,"epssPercentile":0.17245,"slug":"CVE-2026-123096","body":"## Overview\n\nanacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.\n\n## Affected\n\n- `torrent <= 1.61.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}