CVE-2026-123096 anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123096?
CVE-2026-123096 is a high-severity vulnerability in anacrolix torrent, published on 5 Nov 2026.
Official description
anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.
Weakness: CWE-770
Which versions are affected by CVE-2026-123096?
How do I fix CVE-2026-123096?
No fix has been published for CVE-2026-123096 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123096 being exploited?
There is no known exploitation of CVE-2026-123096 in the wild and no public exploit code.
Sources
Also known as GHSA-xhrq-2ff6-99r3.