Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input. The bdecode routine recurses once for each list or dictionary without a depth limit and passes the remaining buffer by value to each recursive call while the branches hold the entire remainder. Consequently, each active stack frame retains its own copy of the shrinking input, leading to quadratic memory growth (O(N²)). A payload with roughly 150 000 nested lists—about 150 KB on the wire—drives peak memory usage into multiple gigabytes, causing the client to crash or become unusable. This demonstrates uncontrolled resource consumption (CWE‑400) and uncontrolled recursion (CWE‑674).

All releases of SANKO Net::BitTorrent prior to version 2.1.0 are affected. The decoder operates on every untrusted bencode source—including .torrent files, BEP09 metadata fetched from peers, DHT messages, and tracker responses—so any client incorporating this module is vulnerable unless it has been upgraded to version 2.1.0 or later.

The flaw is a classic remote memory exhaustion vulnerability. The decoder operates on any untrusted bencoded input, allowing an attacker to trigger it by sending a single deeply nested payload from any peer, or by delivering a crafted .torrent file or magnet link. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the CVSS score of 7.5 confirms a high severity. Because the chunk of data that can be tricked into generating large memory usage is small, the risk remains high until the client is patched or mitigated.