CVE-2026-123096— anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response

Quick assessment

Affected

anacrolix torrent

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

anacrolix/torrent 在 1.61.0 及更早版本中，其 tracker/http 包存在内存耗尽漏洞。恶意跟踪服务器可通过返回无限制大小的响应，导致客户端崩溃。若攻击者控制了 torrent 文件或磁链中的 HTTP 跟踪服务器，即可返回超大体积或经过 gzip 压缩的 announce（宣告）或 scrape（刮取）响应。由于 Client.Announce 和 Client.Scrape 方法在缓冲这些响应时未设置上限，攻击者可借此耗尽进程内存。

CVSS 6.5 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response

Source: CVE Program / CVE List V5

Vulnerability Description

anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
anacrolix	torrent	0 ~ 1.61.0	-

II. Public POCs for CVE-2026-123096

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123096

请登录查看更多情报信息。

Other References for CVE-2026-123096 (5)

https://github.com/anacrolix/torrent/commit/92ad51490479bb8b94720f964b1c67e5a1d68faa patch
https://github.com/anacrolix/torrent/blob/v1.61.0/tracker/http/http.go#L114-L126 technical-description
https://github.com/anacrolix/torrent/pull/1143 issue-tracking patch
https://github.com/anacrolix/torrent product
https://www.vulncheck.com/advisories/anacrolix-torrent-through-1.61.0-memory-exhaustion-via-unbounded-http-tracker-response third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123096

IV. Related Vulnerabilities

Same weakness: CWE-770