The anacrolix/torrent library's bencode decoder lacks any limit on the nesting depth of dictionaries and lists, leading to two denial-of-service vulnerabilities. First, deeply nested lists in a .torrent file can cause a stack overflow crash due to unbounded recursion, terminating the process. Second, the BitTorrent v2 file tree parser re-parses subtrees recursively in a quadratic time complexity manner, causing CPU exhaustion and process hang. These issues affect all applications embedding this library that process untrusted torrent metadata, including CLI tools and clients accepting magnet-link/v2 metadata. A fix is available in version 1.61.1-0.20260911233437-76452a2c8a2f.