Dear Maintainer,

Upstream PR #24869 fixes unbounded allocation of torrent entries in
qBittorrent's embedded tracker. The affected code is present in version
5.1.0, and Debian trixie's 5.1.0-2 patches do not modify it.

On a stopped announce for an unknown torrent ID, unregisterPeer()
returns without creating an entry. However, prepareAnnounceResponse()
then accesses m_torrents through the non-const QHash::operator[], which
creates an entry for the unknown ID.

This bypasses the MAX_TORRENTS limit enforced by registerPeer().
Repeated requests with new torrent IDs can therefore grow the table
without bound and exhaust memory, causing denial of service. The
upstream report states that these entries do not expire.

The attack requires the embedded tracker to be enabled and reachable
by the attacker. It does not require authentication or user interaction.
The embedded tracker is disabled by default.

The upstream fix avoids inserting entries while preparing responses.
The same PR also limits the length of the client-supplied ip parameter,
which is stored per peer. These changes are included in upstream 5.3.0.

References:
- Upstream report and fix:
https://github.com/qbittorrent/qBittorrent/pull/24869
- Affected response generation in 5.1.0:
https://github.com/qbittorrent/qBittorrent/blob/release-5.1.0/src/base/bittorrent/tracker.cpp#L403
- Tracker disabled by default:
https://github.com/qbittorrent/qBittorrent/blob/release-5.1.0/src/base/bittorrent/sessionimpl.cpp#L518
- Debian 5.1.0-2 patch set:
https://sources.debian.org/patches/qbittorrent/5.1.0-2/

Could you assess this issue for security tracking and backporting to the
affected supported Debian releases?

This report is based on the upstream disclosure and source inspection;
I have not reproduced an attack.

Kind regards,
Jonatan Nyberg