CVE-2023-0509

Improper Certificate Validation in pyload/pyload

7.4 HighFix available

CVE-2023-0509 is a high vulnerability (CVSS 7.4) in Pyload, published January 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in pyload-ng 0.5.0b3.dev44.

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.53%Down 0.4 points since Jan 27, 2023

What each source reports

CVE List Score used 7.4

Improper Certificate Validation in pyload/pyload

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

Record: CVE-2023-0509
CVSS 3.0: 7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

EUVDEUVD-2023-0416 7.4

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

Record: EUVD-2023-0416
CVSS 3.0: 7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8v53-23mx-hcf9 7.4

Improper Certificate Validation in pyload-ng

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

Record: GHSA-8v53-23mx-hcf9
CVSS 3.0: 7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

NVD 7.4

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

Record: CVE-2023-0509
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.0: 7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSV 7.4

Improper Certificate Validation in pyload/pyload

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

Record: CVE-2023-0509
CVSS 3.0: 7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSVGHSA-8v53-23mx-hcf9 7.4

Improper Certificate Validation in pyload-ng

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

Record: GHSA-8v53-23mx-hcf9
CVSS 3.0: 7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSVPYSEC-2026-903 7.4

Improper Certificate Validation in pyload-ng

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

Record: PYSEC-2026-903
CVSS 3.0: 7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`pyload-ng` PyPI	before 0.5.0b3.dev44	0.5.0b3.dev44
`pyload-ng` PyPI	before 0.5.0b3.dev44, plus listed versions 0.5.0a5.dev5280.5.0a5.dev5320.5.0a5.dev5350.5.0a5.dev5360.5.0a5.dev537 Show 45 moreShow less 0.5.0a5.dev5390.5.0a5.dev5400.5.0a5.dev5450.5.0a5.dev5620.5.0a5.dev5640.5.0a5.dev5650.5.0a6.dev5700.5.0a6.dev5780.5.0a6.dev5870.5.0a7.dev5960.5.0a8.dev6020.5.0a9.dev6150.5.0a9.dev6290.5.0a9.dev6320.5.0a9.dev6410.5.0a9.dev6430.5.0a9.dev6550.5.0a9.dev8060.5.0b1.dev10.5.0b1.dev20.5.0b1.dev30.5.0b1.dev40.5.0b1.dev50.5.0b2.dev100.5.0b2.dev110.5.0b2.dev120.5.0b2.dev90.5.0b3.dev130.5.0b3.dev140.5.0b3.dev170.5.0b3.dev180.5.0b3.dev190.5.0b3.dev200.5.0b3.dev210.5.0b3.dev220.5.0b3.dev240.5.0b3.dev260.5.0b3.dev270.5.0b3.dev280.5.0b3.dev290.5.0b3.dev300.5.0b3.dev310.5.0b3.dev320.5.0b3.dev330.5.0b3.dev34	0.5.0b3.dev44

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 7 versions. The JSON record has them.