PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-57080 SANKO CVE debrief

CVE-2026-57080 is a remote memory exhaustion vulnerability in Net::BitTorrent versions through 2.1.0 for Perl. The vulnerability allows remote attackers to exhaust the memory of a downloading process by sending an uncapped peer-wire message-length prefix. This is possible because the peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer can announce a length prefix of up to about 4 GiB and then stream bytes, causing the buffer to grow without limit. Since peer connections are unauthenticated, any peer in the swarm can exhaust the downloading process's memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.

Vendor
SANKO
Product
Net::BitTorrent
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-30
Original CVE updated
2026-07-20
Advisory published
2026-06-30
Advisory updated
2026-07-20

Who should care

Users of Net::BitTorrent versions through 2.1.0 for Perl should be aware of this vulnerability and take steps to mitigate it. This includes updating to a patched version of Net::BitTorrent, if available, and implementing compensating controls such as monitoring for anomalous peer connections and limiting the amount of memory allocated to the downloading process.

Technical summary

The vulnerability is caused by the lack of an upper bound on the 4-byte length prefix sent by a connected peer in the peer-wire framing of _process_messages. This allows remote attackers to exhaust the memory of a downloading process by sending a large length prefix and streaming bytes. The vulnerability can be exploited by any peer in the swarm, as peer connections are unauthenticated. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.

Defensive priority

High

Recommended defensive actions

  • Update to a patched version of Net::BitTorrent, if available
  • Implement compensating controls such as monitoring for anomalous peer connections
  • Limit the amount of memory allocated to the downloading process
  • Verify the authenticity of peer connections
  • Review network segmentation and isolation controls for exposed systems
  • Monitor for unusual activity that could indicate exploitation attempts
  • Inventory affected systems and prioritize patching based on criticality

Evidence notes

The CVE record was published on 2026-06-30T12:16:25.533Z and was last modified on 2026-07-20T07:16:38.700Z. The NVD entry is currently Deferred. The vulnerability is described in the CVE record and in the source references.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-30T12:16:25.533Z and has not been modified since then. The NVD entry is currently Deferred.