CVE-2026-57080

{
  "id": "CVE-2026-57080",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-06-30T12:16:25.533",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix.\n\nThe peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the decoder waits until the buffer holds the full message before processing it, so the buffer grows without limit.\n\nPeer connections are unauthenticated, so any peer in the swarm exhausts the downloading process's memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous."
    },
    {
      "lang": "es",
      "value": "Las versiones de Net::BitTorrent hasta la 2.0.1 para Perl permiten el agotamiento remoto de la memoria a través de un prefijo de longitud de mensaje peer-wire sin límite.\n\nEl encuadre peer-wire en _process_messages confía en el prefijo de longitud de 4 bytes enviado por un par conectado sin límite superior, mientras que receive_data añade cada byte entrante al búfer de entrada. Un par anuncia un prefijo de longitud de hasta aproximadamente 4 GiB y luego transmite bytes; el decodificador espera hasta que el búfer contenga el mensaje completo antes de procesarlo, por lo que el búfer crece sin límite.\n\nLas conexiones de pares no están autenticadas, por lo que cualquier par en el enjambre agota la memoria del proceso de descarga. El mensaje legítimo más grande es un bloque de pieza de 16 KiB, por lo que cualquier longitud anunciada muy por encima de eso es anómala."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "SANKO",
          "product": "Net::BitTorrent",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Net-BitTorrent",
          "programFiles": [
            "lib/Net/BitTorrent/Protocol/BEP03.pm"
          ],
          "programRoutines": [
            {
              "name": "Net::BitTorrent::Protocol::BEP03::_process_messages"
            },
            {
              "name": "Net::BitTorrent::Protocol::BEP03::receive_data"
            }
          ],
          "repo": "https://github.com/sanko/Net-BitTorrent.pm",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "2.1.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-30T13:48:40.607424Z",
          "id": "CVE-2026-57080",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-7jr6-2jf4-6qc4",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/SANKO/Net-BitTorrent-v2.1.0/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}