CVE-2026-123096: anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response
anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Clients using anacrolix/torrent through version 1.61.0 are exposed when they contact an attacker-controlled HTTP tracker specified by a torrent file or magnet link. The affected code is in the tracker/http package and applies to both announce and scrape requests.
What must an attacker do to trigger the memory exhaustion?
The attacker must control an HTTP tracker that the client contacts. That tracker can return an oversized response, including a gzip-compressed response that expands substantially when buffered, causing Client.Announce or Client.Scrape to exhaust process memory and crash.
Is user interaction required?
Yes. A client must be induced to use a torrent file or magnet link containing an attacker-controlled HTTP tracker, after which contacting that tracker can trigger the issue.