PatchSiren cyber security CVE debrief
CVE-2026-57080 SANKO CVE debrief
CVE-2026-57080 is a remote memory exhaustion vulnerability in Net::BitTorrent versions through 2.1.0 for Perl. The vulnerability allows remote attackers to exhaust the memory of a downloading process by sending an uncapped peer-wire message-length prefix. This is possible because the peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer can announce a length prefix of up to about 4 GiB and then stream bytes, causing the buffer to grow without limit. Since peer connections are unauthenticated, any peer in the swarm can exhaust the downloading process's memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.
- Vendor
- SANKO
- Product
- Net::BitTorrent
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-30
- Original CVE updated
- 2026-07-20
- Advisory published
- 2026-06-30
- Advisory updated
- 2026-07-20
Who should care
Users of Net::BitTorrent versions through 2.1.0 for Perl should be aware of this vulnerability and take steps to mitigate it. This includes updating to a patched version of Net::BitTorrent, if available, and implementing compensating controls such as monitoring for anomalous peer connections and limiting the amount of memory allocated to the downloading process.
Technical summary
The vulnerability is caused by the lack of an upper bound on the 4-byte length prefix sent by a connected peer in the peer-wire framing of _process_messages. This allows remote attackers to exhaust the memory of a downloading process by sending a large length prefix and streaming bytes. The vulnerability can be exploited by any peer in the swarm, as peer connections are unauthenticated. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.
Defensive priority
High
Recommended defensive actions
- Update to a patched version of Net::BitTorrent, if available
- Implement compensating controls such as monitoring for anomalous peer connections
- Limit the amount of memory allocated to the downloading process
- Verify the authenticity of peer connections
- Review network segmentation and isolation controls for exposed systems
- Monitor for unusual activity that could indicate exploitation attempts
- Inventory affected systems and prioritize patching based on criticality
Evidence notes
The CVE record was published on 2026-06-30T12:16:25.533Z and was last modified on 2026-07-20T07:16:38.700Z. The NVD entry is currently Deferred. The vulnerability is described in the CVE record and in the source references.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-57080 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-57080
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-57080 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-57080
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-7jr6-2jf4-6qc4
9b29abf9-4ab0-4765-b253-1875cd9b441e
-
Source reference
Unverified legacy reference
URL: https://metacpan.org/release/SANKO/Net-BitTorrent-v2.1.0/changes
9b29abf9-4ab0-4765-b253-1875cd9b441e
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.