========================================================================
CVE-2026-57081                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-57081
   Distribution:  Net-BitTorrent
       Versions:  through 2.0.1

       MetaCPAN:  https://metacpan.org/dist/Net-BitTorrent
       VCS Repo:  https://github.com/sanko/Net-BitTorrent.pm

Net::BitTorrent versions through 2.0.1 for Perl allow remote memory
exhaustion via deeply nested bencoded input

Description
-----------
Net::BitTorrent versions through 2.0.1 for Perl allow remote memory
exhaustion via deeply nested bencoded input.

bdecode recurses once per nested list or dictionary level with no depth
cap, and each recursive call receives the remaining buffer by value
while the list and dictionary branches capture the whole remainder, so
every live recursion frame keeps its own copy of the shrinking buffer
(O(N^2) bytes for an N-deep input). The decoder runs on every untrusted
bencode source: .torrent files, BEP09 metadata fetched from peers, DHT
messages, and tracker responses.

A bencoded input of roughly 150,000 nested lists (about 150 KB on the
wire) drives multi-gigabyte peak memory, so one short message from any
peer, or one crafted .torrent file or magnet link, terminates the
client.

Problem types
-------------
- CWE-674 Uncontrolled Recursion
- CWE-400 Uncontrolled Resource Consumption

Workarounds
-----------
There is no fixed release. Cap the bencode nesting depth (libtorrent
rejects beyond about 100 levels) and decode without copying the buffer
remainder at each level.

References
----------
https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-mv44-v82p-89xv