Threats affecting pkg:golang/torrent

CVE-2026-123096 is a memory exhaustion vulnerability in the anacrolix/torrent client up to version 1.61.0. It arises from the tracker/http package where malicious HTTP trackers can send unbounded announce or scrape responses. These responses are buffered without limits by Client.Announce and Client.Scrape, leading to potential process memory exhaustion and client crashes.