Sankopublished

**Name of the Vulnerable Software and Affected Versions** Net::BitTorrent versions prior to 2.0.2 **Description** An issue exists where files can be written outside the designated download directory due to path traversal in peer-supplied metadata. While file path components are validated during .torrent-file ingestion, the metadata path handled by the ` on metadata received()` function (accessed via the BEP09 ut metadata extension) passes attacker-supplied file names directly to `Storage::add file()` and `Storage:: parse file tree()`. Because the `child()` function in Path::Tiny does not collapse ".." segments, a v2 file tree key, a v1 `files[].path` element, or a single-file name containing these segments can resolve to locations outside the download directory. Since the peer also controls piece hashes and served bytes, content verification is bypassed, allowing an attacker to write arbitrary content to an arbitrary path on the host. **Recommendations** Update Net::BitTorrent to a version newer than 2.0.1.

**Name of the Vulnerable Software and Affected Versions** Net::BitTorrent versions prior to 2.0.2 **Description** Remote memory exhaustion is possible due to an uncapped peer-wire message-length prefix. The peer-wire framing in the ` process messages()` function trusts the 4-byte length prefix sent by a connected peer without an upper bound, while `receive data()` appends every inbound byte to the input buffer. An unauthenticated peer can announce a length prefix of up to approximately 4 GiB and stream bytes, causing the buffer to grow without limit as the decoder waits for the full message. Since the largest legitimate message is a 16 KiB piece block, any length significantly exceeding this is anomalous. **Recommendations** Update Net::BitTorrent to version 2.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Net::BitTorrent versions prior to 2.0.2 **Description** Remote memory exhaustion is possible through the processing of deeply nested bencoded input. The `bdecode()` function recurses for each nested list or dictionary level without a depth limit. During this process, each recursive call receives the remaining buffer by value, causing every active recursion frame to maintain its own copy of the shrinking buffer, resulting in O(N^2) memory consumption. This issue affects the processing of .torrent files, BEP09 metadata from peers, DHT messages, and tracker responses. For example, a bencoded input containing approximately 150,000 nested lists (roughly 150 KB) can trigger multi-gigabyte peak memory usage, leading to client termination. **Recommendations** Update Net::BitTorrent to version 2.0.2 or later.