CVE-2026-57080 is a resource exhaustion vulnerability in SANKO's Net::BitTorrent Perl module versions up to 2.0.1. The vulnerability arises because the peer-wire protocol implementation trusts the 4-byte length prefix from connected peers without enforcing an upper bound. The receive_data function appends all incoming bytes to the input buffer, and the decoder waits until the full message is received before processing. A malicious peer can announce a message length of up to approximately 4 GiB and stream that many bytes, causing the buffer to grow without limit and exhaust memory. Peer connections are unauthenticated, so any peer in the swarm can exploit this to exhaust the downloader's memory. The largest legitimate message is a 16 KiB piece block, so any length prefix significantly larger than this is anomalous and indicative of an attack.

An attacker controlling a peer in the BitTorrent swarm can cause the target process running Net::BitTorrent to exhaust its memory resources by sending a large message-length prefix and streaming a correspondingly large message. This can lead to denial of service due to memory exhaustion. There is no indication of code execution or data corruption from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting exposure to untrusted peers or implementing network-level controls to detect and block anomalous large message-length prefixes. Since peer connections are unauthenticated, restricting connections to trusted peers may reduce risk.