Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-57080 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique SMS Pumping (T1496.003); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-40289
Vulnerability Data
Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound…
more
byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the decoder waits until the buffer holds the full message before processing it, so the buffer grows without limit. Peer connections are unauthenticated, so any peer in the swarm exhausts the downloading process's memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
—
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Directly enforces a hard limit on concurrent sessions, structurally preventing unbounded resource allocation.
SC-5 directly limits the effects of resource-exhaustion events that constitute uncontrolled consumption.
SC-6 enforces explicit allocation limits on resources, structurally preventing the weakness from occurring.
Imposes a limit on consecutive invalid attempts, preventing one specific class of unbounded resource consumption.
Process isolation confines resource consumption to separate domains, reducing blast radius without stopping the root flaw.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
Monitoring capacity and taking action to maintain availability directly reduces unchecked resource allocation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
Resource-utilization monitoring and alerting on bottlenecks or overloads limits the impact of denial-of-service or resource-exhaustion attacks.
A.8.29's combined programme of code review, static analysis, dynamic testing and penetration testing reaches CWE-770 through both SOURCE and RUNTIME: missing throttling, unbounded allocation loops and absent connection limits are patterns static analysis and code review surface, and DoS-style stress testing catches them at runtime. The remainder is bounded and nameable — limits that exist but are set too high for the deployment context, race conditions in resource accounting, and design-level decisions about whether a limit belongs at all — which keeps this below the `full` rung A.8.29 reaches on CWE-89.
Early notification of anomalous resource consumption or system malfunctions enables throttling or isolation before availability is lost.
Monitoring network service usage and applying controls to restrict access when necessary limits an attacker’s ability to consume excessive resources through unrestricted or unauthenticated service calls.
A.8.28 mandates secure coding practices — threat modelling, coding standards, peer review, knowledge of common defects — that can catch missing resource limits before code ships, but it is a fallible human practice whose coverage depends on implementer rigour, leaving a nameable remainder that A.8.29 testing reaches more reliably.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over our cross-walk; rows rated `none` are excluded, and each rule says how its mapping was checked.
Definition changed on 29 October 2026. Until then this section listed every rule rated above none, partial included. From that date it lists rules whose mapping is rated full or mostly and checked at llm_unverified or higher; partial mappings show when you ask.
Oracle Linux 8 (1 rule, 1 more partial)
- V-248552 OL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. blocks CWE-770
- V-248553 OL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. blocks CWE-770
Oracle Linux 9 (1 rule, 1 more partial)
- V-271710 OL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. blocks CWE-770
- V-271709 OL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. blocks CWE-770
RHEL 8 (1 rule)
- V-230244 RHEL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. blocks CWE-770