Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| anacrolix | torrent | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 05 Nov 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory. | |
| Title | anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response | |
| First Time appeared |
Torrentflux Project
Torrentflux Project torrentflux |
|
| Weaknesses | CWE-770 | |
| CPEs | cpe:2.3:a:torrentflux_project:torrentflux:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Torrentflux Project
Torrentflux Project torrentflux |
|
| References |
|
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-05T15:11:50.578Z
Reserved: 2026-11-05T12:22:13.477Z
Link: CVE-2026-123096
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-770
Allocation of Resources Without Limits or Throttling