{"id":"GO-2026-6894","summary":"anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in github.com/anacrolix/torrent","details":"anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in github.com/anacrolix/torrent","aliases":["GHSA-2wrx-84qj-4pcg"],"modified":"2026-11-05T23:15:18.146197206Z","published":"2026-11-05T22:55:03Z","database_specific":{"review_status":"UNREVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6894"},"references":[{"type":"ADVISORY","url":"https://github.com/anacrolix/torrent/security/advisories/GHSA-2wrx-84qj-4pcg"},{"type":"FIX","url":"https://github.com/anacrolix/torrent/commit/76452a2c8a2fd9c59d4d4f10fc3495723d538c7b"}],"affected":[{"package":{"name":"github.com/anacrolix/torrent","ecosystem":"Go","purl":"pkg:golang/github.com/anacrolix/torrent"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.61.1-0.20260911233437-76452a2c8a2f"}]}],"ecosystem_specific":{"imports":[{"symbols":["Decoder.Decode","Decoder.parseStringLength","Decoder.parseValue","Decoder.parseValueInterface","Decoder.readOneValue","Unmarshal"],"path":"github.com/anacrolix/torrent/bencode"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6894.json"}}],"schema_version":"1.9.2"}