Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-123096anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response

Medium 6.5

In plain English

A medium-severity resource allocation without limits in torrent from anacrolix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 82.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.

Affected products (as reported)

Vendor	Product	Versions
anacrolix	torrent	0 – through 1.61.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/anacrolix/torrent/pull/1143 issue-tracking, patch
https://github.com/anacrolix/torrent/commit/92ad51490479bb8b94720f964b1c67e5a1d68faa patch
https://github.com/anacrolix/torrent/blob/v1.61.0/tracker/http/http.go#L114-L126 technical-description
https://github.com/anacrolix/torrent product
VulnCheck Advisory: anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response third-party-advisory