Medium, CVSS 6.5GoAmendedPublished
anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS
GHSA-2wrx-84qj-4pcg
- Affected
- Go github.com/anacrolix/torrent < 1.61.1-0.20260911233437-76452a2c8a2f
- Fixed in
- 1.61.1-0.20260911233437-76452a2c8a2f· Vendor fix available
- Issue
- anacrolix/torrent's bencode decoder (`bencode/`) applies no limit on the nesting depth of nested dictionaries and lists. Two distinct denial-of-service mechanisms follow from that single root cause, both reachable from a single crafted `.torrent` file or from metadata obtained from a peer on a magnet-link/v2 download: 1. Stack-overflow process crash. `Decoder.readOneValue` recurses once per nesting level with no depth bound. A `.torrent` whose `info` value is a list nested a few million levels deep (≈8 MB file) drives the recursion past the 1 GiB goroutine-stack limit and the process dies with an unrecoverable `fatal error: stack overflow`. 2. Quadratic CPU exhaustion. `metainfo.FileTree.UnmarshalBencode` (BitTorrent v2) re-parses each subtree at every level, making parse time grow ~O(n²). A v2 info dict with a ~30,000-level file tree (≈0.2 MB) takes ~66 s to decode; 60,000 levels exceeds 90 s of decode time. Affected: every application embedding…
Recommended action: Upgrade to 1.61.1-0.20260911233437-76452a2c8a2f (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.