The identified vulnerability in Net::BitTorrent versions through 2.1.0 for Perl, a module released by SANKO, allows remote memory exhaustion by accepting an uncapped peer‑wire message‑length prefix. The receiving routine appends each inbound byte to an input buffer and delays decoding until the buffer holds the full message advertised by the peer. If a peer announces a length prefix of up to about 4 GiB and streams bytes, the buffer grows without limit. Because peer connections are unauthenticated and the module fails to validate the length field, this flaw falls under CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Uncontrolled Memory Allocation). The result is that any malicious peer can cause the downloading process to exhaust available memory, potentially crash or become unresponsive, thereby denying service to legitimate users.

The affected product is Net::BitTorrent, a Perl module used to build BitTorrent clients, with all releases through version 2.1.0 vulnerable. The official fix is to upgrade to version 2.1.0 or later, as advised by the CNA.

The attack vector is remote, via the peer‑wire protocol used by BitTorrent peers. Because peer connections are unauthenticated, any malicious peer can initiate the attack. The exploit requires no special privileges or additional software beyond a standard BitTorrent client. The CVSS score of 7.5 denotes a high severity, and, combined with an EPSS below 1% and no KEV listing, the lack of mitigation mechanisms in the library and the potential for large memory consumption make this a high‑risk denial‑of‑service flaw.