A division‑by‑zero error in the BitTorrent helper of Aria2 causes the program to crash when a malicious user provides crafted input. The crash occurs during processing of torrent metadata, leading to an immediate denial of service for the affected process. This weakness allows a remote attacker to interrupt downloads or bring the service offline without compromising confidentiality or integrity.

Aria2, the open‑source BitTorrent client, is affected for version 1.37.0 and all earlier releases. No vendor or product list beyond the Aria2 application is provided.

The exploit can be triggered remotely; however, the CVE does not detail the exact method of exploitation. EPSS data is < 1% and the vulnerability is not listed in the CISA KEV catalog, so the exact exploitation frequency is unknown. The CVSS score of 6.2 indicates moderate severity, but the potential to bring a download service to a halt makes it a significant concern for any environment where Aria2 is exposed to untrusted input.