CVE-2026-57080 is a resource exhaustion vulnerability in SANKO's Net::BitTorrent Perl module versions up to 2.0.1. The vulnerability arises because the peer-wire protocol implementation trusts the 4-byte length prefix sent by connected peers without enforcing an upper bound. The receive_data function appends all incoming bytes to the input buffer, and the decoder waits until the full message is received before processing. A malicious peer can announce a length prefix up to approximately 4 GiB and stream bytes accordingly, causing the buffer to grow without limit and exhausting memory. Since peer connections are unauthenticated, any peer in the swarm can exploit this to cause denial of service. Legitimate messages are much smaller (largest is 16 KiB), so large length prefixes are anomalous.

An attacker can remotely cause a denial of service by exhausting the memory of the process running Net::BitTorrent. This does not affect confidentiality or integrity but results in high impact on availability due to uncontrolled memory growth.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or validating peer message lengths at the application or network level to prevent processing of anomalously large messages.