Vulnerabilities

Security research · GHSA-2wrx-84qj-4pcg

anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · anacrolix torrent has unbounded

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-2wrx-84qj-4pcg. A missing EPSS score is not a low risk. Compare anacrolix torrent has unbounded with the linked advisory before you change production.

Severity

Medium6.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Advisory link

Affected products

Go github.com/anacrolix/torrent

## Summary anacrolix/torrent's bencode decoder ( ) applies **no limit on the nesting depth** of nested dictionaries and lists. Two distinct denial-of-service mechanisms follow from that single root cause, both reachable from a single crafted file or from metadata obtained from a peer on a magnet-link/v2 download: 1. **Stack-overflow process crash.** recurses once per nesting level with no depth bound. A whose value is a list nested a few million levels deep (≈8 MB file) drives the recursion past the 1 GiB goroutine-stack limit and the process dies with an unrecoverable . 2. **Quadratic CPU exhaustion.** (BitTorrent v2) re-parses each subtree at every level, making parse time grow ~O(n²). A v2 info dict with a ~30,000-level file tree (≈0.2 MB) takes ~66 s to decode; 60,000 levels exceeds 90 s of decode time. Affected: every application embedding that ingests attacker-supplied metainfo - the CLI tools ( , ), any server that opens files, or any client that accepts metadata from a peer for a magnet/v2 download. No depth limit has ever existed in the decoder. ## Vulnerability Details All file:line references are against the pinned commit . ### Root cause - no recursion/depth limit in the bencode decoder implements three independently unbounded recursive parsers. There is no depth counter and no /nesting guard anywhere in or . **Defect 1 - recursion ( )** is invoked by ( ) whenever a decoded field implements , which includes - the type of ( ). So decoding a normal routes the entire value through this recursion. Stack usage is ~256 bytes per level (consistent with the observed ~4M-level crash at the 1 GiB goroutine-stack limit), so nesting a few million levels deep exhausts the 1 GiB default goroutine-stack limit. Go's stack overflow is a - it is not a recoverable panic, so the in ( ) cannot intercept it, and the whole process terminates. Entry points that reach with attacker-controlled bytes: - ( ) / ( ) - decoding a file; the value becomes a unmarshaler field. - / -> ( i