/ 
Net-BitTorrent-v2.1.0
⭐ Starred 13 / Net::BitTorrent::Protocol::BEP11
Security Advisories (2)
CVE-2026-57080 (2026-06-30)

Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the decoder waits until the buffer holds the full message before processing it, so the buffer grows without limit. Peer connections are unauthenticated, so any peer in the swarm exhausts the downloading process's memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.

CVE-2026-57081 (2026-06-30)

Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by value while the list and dictionary branches capture the whole remainder, so every live recursion frame keeps its own copy of the shrinking buffer (O(N^2) bytes for an N-deep input). The decoder runs on every untrusted bencode source: .torrent files, BEP09 metadata fetched from peers, DHT messages, and tracker responses. A bencoded input of roughly 150,000 nested lists (about 150 KB on the wire) drives multi-gigabyte peak memory, so one short message from any peer, or one crafted .torrent file or magnet link, terminates the client.

NAME

Net::BitTorrent::Protocol::BEP11 - Peer Exchange (PEX) Implementation

SYNOPSIS

# Inherits from Net::BitTorrent::Protocol::BEP09
use Net::BitTorrent::Protocol::BEP11;

# Notify peer about new and dropped neighbors
$proto->send_pex(
    [{ ip => '1.2.3.4', port => 6881 }], # added
    [{ ip => '5.6.7.8', port => 6881 }]  # dropped
);

DESCRIPTION

Net::BitTorrent::Protocol::BEP11 implements the Peer Exchange (PEX, BEP 11) protocol. PEX allows peers to directly share the addresses of other peers they are connected to, dramatically reducing the time it takes to find a healthy swarm and reducing load on trackers and DHT nodes.

It runs as a sub-protocol of the Extension Protocol (BEP 10) under the name ut_pex.

METHODS

send_pex( [$added], [$dropped], [$added6], [$dropped6] )

Sends a Peer Exchange update.

$proto->send_pex(
    [{ ip => '1.2.3.4', port => 6881 }],
    [{ ip => '5.6.7.8', port => 6881 }]
);

This method sends a ut_pex message containing lists of newly discovered and recently disconnected peers.

Expected parameters:

$added - optional

Array reference of newly discovered IPv4 peers. Each must be a hash reference with ip and port.

$dropped - optional

Array reference of IPv4 peers that have disconnected.

$added6 - optional

Array reference of newly discovered IPv6 peers.

$dropped6 - optional

Array reference of IPv6 peers that have disconnected.

pex event

Emitted when a PEX message is received.

$proto->on( pex => sub ( $self, $added, $dropped, $added6, $dropped6 ) { ... } );

Expected parameters:

$added

Array reference of added IPv4 peers.

$dropped

Array reference of dropped IPv4 peers.

$added6

Array reference of added IPv6 peers.

$dropped6

Array reference of dropped IPv6 peers.

SPECIFICATIONS

  • BEP 11: Peer Exchange (PEX)

AUTHOR

Sanko Robinson - https://github.com/sanko

COPYRIGHT

Copyright (C) 2008-2026 by Sanko Robinson.

This library is free software; you can redistribute it and/or modify it under the terms of the Artistic License 2.0.