anacrolix/torrent through version 1.61.0 is vulnerable to memory exhaustion caused by unbounded handling of tracker responses. The bug allows an adversary controlling an HTTP tracker used in a torrent file or magnet link to send arbitrarily large or gzip‑compressed announce or scrape responses. The client processes these responses into internal buffers without any size limits, leading to excessive memory allocation and eventual application crash, which results in a denial of service to users relying on the client.

Vendors and products affected are the anacrolix torrent library and any applications that embed it. All releases of anacrolix/torrent up to and including 1.61.0 are impacted. The library is distributed under the Cargo package manager for Go and is commonly used in user‑generated torrent clients. No specific version ranges beyond 1.61.0 are listed, so any deployment using that version or an earlier release that has not been patched is vulnerable.

With a CVSS base score of 7.1, the vulnerability shows a medium‑to‑high severity. The EPSS score is not reported, indicating that the public exploitation probability is either low or data is unavailable. The issue is not registered in the CISA KEV catalog, which suggests no widespread, active exploitation. Attackers would need control of an HTTP tracker or the ability to influence its responses, which can be achieved by hosting a malicious tracker or placing a compromised tracker address in a torrent file or magnet link. Once in position, they can send enormous responses that fragment system memory until the client process terminates, causing a denial of service. Inference: the required attack vector is external over the network to the HTTP tracker endpoint.