These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG. The MSE handshake derives its 160-bit Diffie-Hellman private key from Perl's rand(), a non-cryptographic drand48-class generator seeded once per process, in KeyExchange.pm. A passive observer of the handshake recovers the PRNG state from the cleartext padding, reconstructs the private [truncated]
CVE-2026-57081 is a high-severity vulnerability in the Net::BitTorrent Perl module, allowing remote attackers to cause memory exhaustion via deeply nested bencoded input. The vulnerability exists due to the lack of a depth cap in the bdecode function, which leads to excessive memory usage. This issue affects Net::BitTorrent versions up to 2.1.0 and can be exploited by remote attackers to cause denial-of-s [truncated]
CVE-2026-57080 is a remote memory exhaustion vulnerability in Net::BitTorrent versions through 2.1.0 for Perl. The vulnerability allows remote attackers to exhaust the memory of a downloading process by sending an uncapped peer-wire message-length prefix. This is possible because the peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while [truncated]