Every CVE Search/ Get API key

CVE-2026-48484

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

6.5 MediumFix available

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in api_blueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read(). This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.37%Up 0.1 points since Oct 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in api_blueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read(). This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.

Record
CVE-2026-48484
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-400
Updated
2026-11-02
EUVDEUVD-2026-95910 6.5

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in api_blueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read(). This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.

Record
EUVD-2026-95910
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-vq8p-m3wm-gv5f 6.5

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Description:

The API rpc function in api_blueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read(). This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination.

VulnerableCode & Path:

https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73

Steps to Reproduce:

  1. Log in to pyLoad (or use an API key, here i used api to communicate).
  2. Prepare a large file (e.g., 10GB) .
truncate -s 10G large_file.bin
  1. Send a multipart request to an API function that accepts a file, such as check_online_status_container:
curl -X POST "http://localhost:8000/api/rpc" \
     -H "X-API-Key: YOUR_API_KEY" \
     -F "func=check_online_status_container" \
     -F "container=@large_file.bin"
  1. Monitor the server's memory usage. The process will attempt to allocate memory for the entire file and last the process will be killed by the kernel. <img width="1902" height="610" alt="dos-process-kill-poc" src="https://github.com/user-attachments/assets/2b9bfd0f-5b9f-48dd-983f-f97dfcc358cc" />

Impact

  • Denial of Service (DoS): The pyLoad process will be killed by the Operating System's Out-Of-Memory (OOM) killer, or the entire system may become unresponsive due to swap thrashing or memory exhaustion.
  • Service Instability: Any active downloads or tasks will be interrupted.

Mitigations

  • Implement File Size Limits: Enforce a maximum size for uploaded files in the web server configuration (e.g., Nginx client_max_body_size).
Record
GHSA-vq8p-m3wm-gv5f
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-400
Updated
2026-11-02
NVD 6.5

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in api_blueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read(). This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.

Record
CVE-2026-48484
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-400
Updated
2026-11-02
OSV 6.5

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in api_blueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read(). This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.

Record
CVE-2026-48484
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-400
Updated
2026-11-02
OSVGHSA-vq8p-m3wm-gv5f 6.5

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Description:

The API rpc function in api_blueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read(). This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination.

VulnerableCode & Path:

https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73

Steps to Reproduce:

  1. Log in to pyLoad (or use an API key, here i used api to communicate).
  2. Prepare a large file (e.g., 10GB) .
truncate -s 10G large_file.bin
  1. Send a multipart request to an API function that accepts a file, such as check_online_status_container:
curl -X POST "http://localhost:8000/api/rpc" \
     -H "X-API-Key: YOUR_API_KEY" \
     -F "func=check_online_status_container" \
     -F "container=@large_file.bin"
  1. Monitor the server's memory usage. The process will attempt to allocate memory for the entire file and last the process will be killed by the kernel. <img width="1902" height="610" alt="dos-process-kill-poc" src="https://github.com/user-attachments/assets/2b9bfd0f-5b9f-48dd-983f-f97dfcc358cc" />

Impact

  • Denial of Service (DoS): The pyLoad process will be killed by the Operating System's Out-Of-Memory (OOM) killer, or the entire system may become unresponsive due to swap thrashing or memory exhaustion.
  • Service Instability: Any active downloads or tasks will be interrupted.

Mitigations

  • Implement File Size Limits: Enforce a maximum size for uploaded files in the web server configuration (e.g., Nginx client_max_body_size).
Record
GHSA-vq8p-m3wm-gv5f
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-400
Updated
2026-11-02
OSVPYSEC-2026-4293 6.5

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Description:

The API rpc function in api_blueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read(). This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination.

VulnerableCode & Path:

https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73

Steps to Reproduce:

  1. Log in to pyLoad (or use an API key, here i used api to communicate).
  2. Prepare a large file (e.g., 10GB) .
truncate -s 10G large_file.bin
  1. Send a multipart request to an API function that accepts a file, such as check_online_status_container:
curl -X POST "http://localhost:8000/api/rpc" \
     -H "X-API-Key: YOUR_API_KEY" \
     -F "func=check_online_status_container" \
     -F "container=@large_file.bin"
  1. Monitor the server's memory usage. The process will attempt to allocate memory for the entire file and last the process will be killed by the kernel. <img width="1902" height="610" alt="dos-process-kill-poc" src="https://github.com/user-attachments/assets/2b9bfd0f-5b9f-48dd-983f-f97dfcc358cc" />

Impact

  • Denial of Service (DoS): The pyLoad process will be killed by the Operating System's Out-Of-Memory (OOM) killer, or the entire system may become unresponsive due to swap thrashing or memory exhaustion.
  • Service Instability: Any active downloads or tasks will be interrupted.

Mitigations

  • Implement File Size Limits: Enforce a maximum size for uploaded files in the web server configuration (e.g., Nginx client_max_body_size).
Record
PYSEC-2026-4293
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pyload-ng
PyPI
 before 0.5.0b3.dev101
0.5.0b3.dev101
pyload-ng
PyPI
 before 0.5.0b3.dev101, plus listed versions
0.5.0a5.dev5280.5.0a5.dev5320.5.0a5.dev5350.5.0a5.dev5360.5.0a5.dev537
Show 45 moreShow less
0.5.0a5.dev5390.5.0a5.dev5400.5.0a5.dev5450.5.0a5.dev5620.5.0a5.dev5640.5.0a5.dev5650.5.0a6.dev5700.5.0a6.dev5780.5.0a6.dev5870.5.0a7.dev5960.5.0a8.dev6020.5.0a9.dev6150.5.0a9.dev6290.5.0a9.dev6320.5.0a9.dev6410.5.0a9.dev6430.5.0a9.dev6550.5.0a9.dev8060.5.0b1.dev10.5.0b1.dev20.5.0b1.dev30.5.0b1.dev40.5.0b1.dev50.5.0b2.dev100.5.0b2.dev110.5.0b2.dev120.5.0b2.dev90.5.0b3.dev1000.5.0b3.dev130.5.0b3.dev140.5.0b3.dev170.5.0b3.dev180.5.0b3.dev190.5.0b3.dev200.5.0b3.dev210.5.0b3.dev220.5.0b3.dev240.5.0b3.dev260.5.0b3.dev270.5.0b3.dev280.5.0b3.dev290.5.0b3.dev300.5.0b3.dev310.5.0b3.dev320.5.0b3.dev33
0.5.0b3.dev101

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-48484 is a medium vulnerability (CVSS 6.5) in Pyload, published October 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in pyload-ng 0.5.0b3.dev101.

References

This page doesn't list everything

Left out here: 55 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open