/ 
Net-BitTorrent-v2.1.0
⭐ Starred 13 / Net::BitTorrent::Protocol::BEP06
Security Advisories (2)
CVE-2026-57080 (2026-06-30)

Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the decoder waits until the buffer holds the full message before processing it, so the buffer grows without limit. Peer connections are unauthenticated, so any peer in the swarm exhausts the downloading process's memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.

CVE-2026-57081 (2026-06-30)

Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by value while the list and dictionary branches capture the whole remainder, so every live recursion frame keeps its own copy of the shrinking buffer (O(N^2) bytes for an N-deep input). The decoder runs on every untrusted bencode source: .torrent files, BEP09 metadata fetched from peers, DHT messages, and tracker responses. A bencoded input of roughly 150,000 nested lists (about 150 KB on the wire) drives multi-gigabyte peak memory, so one short message from any peer, or one crafted .torrent file or magnet link, terminates the client.

NAME

Net::BitTorrent::Protocol::BEP06 - Fast Extension Implementation

SYNOPSIS

# Inherits from Net::BitTorrent::Protocol::BEP55 (Holepunching)
use Net::BitTorrent::Protocol::BEP06;

# Inform peer we have everything immediately
$proto->send_have_all( );

# Explicitly reject a request (instead of ignoring it)
$proto->send_reject( $index, $begin, $length );

DESCRIPTION

Net::BitTorrent::Protocol::BEP06 implements the Fast Extension (BEP 06). This extension improves swarm efficiency by adding several messages that reduce latency during startup and provide better error handling for block requests.

METHODS

send_have_all( )

Signals that the local client has all pieces.

$proto->send_have_all();

This method sends a HAVE_ALL message, signaling that we are a seeder.

send_have_none( )

Signals that the local client has no pieces.

$proto->send_have_none();

This method sends a HAVE_NONE message, signaling that we are a leecher with no data yet.

send_suggest( $index )

Suggests a piece to the remote peer.

$proto->send_suggest( 42 );

This method sends a SUGGEST_PIECE message, hinting that the specified piece is available and would be efficient to download.

Expected parameters:

$index

The zero-based piece index.

send_reject( $index, $begin, $length )

Rejects a block request.

$proto->send_reject( 0, 0, 16384 );

This method informs the peer that their request for a specific block has been rejected, allowing them to immediately retry other peers.

Expected parameters:

$index

The piece index.

$begin

The byte offset within the piece.

$length

The number of bytes requested.

send_allowed_fast( $index )

Allows a piece to be requested even if choked.

$proto->send_allowed_fast( 5 );

This method informs the peer that they can request the specified piece even if they are currently choked.

Expected parameters:

$index

The piece index.

have_all event

Emitted when a HAVE_ALL message is received.

$proto->on( have_all => sub ( $self ) { ... } );

have_none event

Emitted when a HAVE_NONE message is received.

$proto->on( have_none => sub ( $self ) { ... } );

suggest event

Emitted when a SUGGEST_PIECE message is received.

$proto->on( suggest => sub ( $self, $index ) { ... } );

Expected parameters:

$index

The suggested piece index.

reject event

Emitted when a REJECT_REQUEST message is received.

$proto->on( reject => sub ( $self, $index, $begin, $length ) { ... } );

Expected parameters:

$index

The piece index.

$begin

The byte offset.

$length

The length of the rejected block.

allowed_fast event

Emitted when an ALLOWED_FAST message is received.

$proto->on( allowed_fast => sub ( $self, $index ) { ... } );

Expected parameters:

$index

The allowed piece index.

SPECIFICATIONS

  • BEP 06: Fast Extension

AUTHOR

Sanko Robinson - https://github.com/sanko

COPYRIGHT

Copyright (C) 2008-2026 by Sanko Robinson.

This library is free software; you can redistribute it and/or modify it under the terms of the Artistic License 2.0.