CVE-2026-57081 is a high-severity vulnerability in SANKO's Net::BitTorrent Perl module (versions <=2.0.1) caused by uncontrolled recursion in the bdecode function. The decoder recurses once per nested list or dictionary level without limiting recursion depth. Each recursive call copies the remaining buffer by value, and list/dictionary branches capture the entire remainder, resulting in O(N^2) memory usage for N levels of nesting. This flaw allows remote attackers to cause memory exhaustion and crash the client by sending deeply nested bencoded input via any untrusted source such as .torrent files, BEP09 metadata, DHT messages, or tracker responses. No official patch or remediation is currently documented.

The vulnerability leads to denial of service through memory exhaustion, causing the Net::BitTorrent client to terminate unexpectedly. There is no impact on confidentiality or integrity reported. The attack vector is remote and requires no privileges or user interaction. The CVSS 3.1 score is 7.5 (High), reflecting the ease of exploitation and the severe availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted or suspicious bencoded data from peers, .torrent files, or network sources. Implementing input validation or limiting recursion depth in the bdecode function could mitigate the risk, but no official or temporary fixes are documented at this time.