CVE-2026-123096
Description
A flaw was found in anacrolix/torrent. A remote attacker controlling a malicious HTTP tracker can cause a Denial of Service (DoS) by returning excessively large or compressed responses to announce or scrape requests. Because the client buffers incoming HTTP responses without size restrictions, processing these payloads exhausts process memory and crashes the client application.
Statement
This vulnerability is rated as Moderate for Red Hat because exploitation depends on user interaction to connect to an adversarial tracker, restricting the impact to a denial of service of the affected client process. Red Hat Enterprise Linux and core enterprise offerings do not distribute or execute BitTorrent client workflows by default. Successful triggering leads exclusively to process termination without risking confidential information disclosure or unauthorized data modification.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
