1) About Rencode Rencode is a "Python module for fast (basic) object serialization similar to bencode". https://github.com/aresch/rencode This library is used as a faster and more efficient data encoder than bencode. There are implementations in other languages: Golang, Javascript, Java, Ruby, dart, etc Some of these ports carry the same bug, the Go port does. (as an aside - not all of these derived works have preserved the original copyright and license) 2) Vulnerability https://github.com/aresch/rencode/pull/29 Given malformed input, the rencode parser enters an infinite loop. The shortest rencoded string to trigger this bug is ';\x2f\x7f' but there is an infinite number of possibilities. Although the library is accelerated in Cython, it cannot release the global interpreter lock so the Python interpreter process is irreparably locked up once the loop is entered. The software becomes unresponsive and consumes CPU until the process runs out of memory and is terminated - which can take a *very* long time. 3) Affected software There are at least two active open-source network facing projects using the vulnerable python rencode library in their transport layer: xpra and deluge. Xpra is a remote desktop access tool - aka "screen for X11" and Deluge is a bittorrent client. There are other programs out there using this library but they are less prominent or not network facing, though there may well be more vulnerable software written in other languages. 4) Example DoS against xpra Xpra uses rencode for structured messages between its processes, typically between clients and servers. Given an xpra process listening on a TCP port, sending this tiny (11 bytes) malformed packet triggers the DoS: 'P\x01\x00\x00\x00\x00\x00\x03;/\x7f' This does not require any authentication. Some packaged installations create a system wide proxy server which runs as root and listens on the IANA assigned TCP port 14500. Other socket types don't make it any harder to trigger (ie: websockets, SSL), only requiring extra packet encapsulation. Local users may also have access to other user's unix domain sockets. 5) Mitigation The easiest way is to remove the Cython accelerated version of rencode: rm `python3 -c "from rencode import _rencode;print(_rencode.__file__)"` As the pure Python fallback implementation does not have this bug. 6) Disclosure timeline 2021-08-05 bug discovered, fix provided 2021-08-06 requested a CVE from mitre 2021-08-10 fix applied in rencode 2021-09-07 disclosure