{"id":"CVE-2026-38361","aliases":["EUVD-2026-28645","GHSA-xp7f-v245-w3w8","PYSEC-2026-37"],"status":"published","title":"An issue in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute...","description":"Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_uploader/upload.py) trusts unsanitized, attacker-controlled upload parameters (e.g. flowTotalChunks) and does not enforce the documented max_file_size limit, allowing a remote, unauthenticated attacker to cause an out-of-memory (OOM) process crash (unbounded range(1, flowTotalChunks + 1) allocation), truncation of the target file to zero bytes (flowTotalChunks=0, where the all([]) == True quirk runs the file-assembly branch on zero chunks), permanent disk exhaustion (never-cleaned-up temporary directories per flowIdentifier), and a complete bypass of the documented max_file_size limit.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02643,"percentile":0.85789,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-400","CWE-670"],"published":"2026-05-08T00:00:00Z","modified":"2026-11-08T16:10:00Z","exploits":[{"source":"pocgithub","id":"a1ohadance/CVE-2026-38361","title":"a1ohadance/CVE-2026-38361","date":"2026-05-07","url":"https://github.com/a1ohadance/CVE-2026-38361"},{"source":"nuclei","id":"CVE-2026-38361","title":"dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-38361.yaml"}],"fixes":[{"ecosystem":"PyPI","package":"dash-uploader","fixed_in":["0.7.0a1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"PyPI","package":"dash-uploader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.7.0a1"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.2.0","0.2.3","0.2.4","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.5.0","0.6.0","0.6.1"]}],"products":[{"vendor":"fohrloop","product":"dash-uploader"}],"references":[{"url":"https://github.com/fohrloop/dash-uploader","tags":["Product","package"]},{"url":"https://pypi.org/project/dash-uploader/","tags":["Product","package"]},{"url":"https://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py","tags":["Product","web"]},{"url":"https://github.com/fohrloop/dash-uploader/issues/153","tags":["Product","report"]},{"url":"https://pypistats.org/packages/dash-uploader","tags":["Product","web"]},{"url":"https://libraries.io/pypi/dash-uploader","tags":["Product","web"]},{"url":"https://pepy.tech/project/dash-uploader","tags":["Product","web"]},{"url":"https://docs.python.org/3/library/functions.html#all","tags":["Product","web"]},{"url":"https://github.com/a1ohadance/CVE-2026-38361","tags":["exploit","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/github/advisory-database/pull/7636"},{"url":"https://github.com/advisories/GHSA-xp7f-v245-w3w8"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38361"},{"url":"https://pypi.org/project/dash-uploader"}],"sources":{"cve":[{"id":"CVE-2026-38361","description":"Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_uploader/upload.py) trusts unsanitized, attacker-controlled upload parameters (e.g. flowTotalChunks) and does not enforce the documented max_file_size limit, allowing a remote, unauthenticated attacker to cause an out-of-memory (OOM) process crash (unbounded range(1, flowTotalChunks + 1) allocation), truncation of the target file to zero bytes (flowTotalChunks=0, where the all([]) == True quirk runs the file-assembly branch on zero chunks), permanent disk exhaustion (never-cleaned-up temporary directories per flowIdentifier), and a complete bypass of the documented max_file_size limit.","status":"published","published":"2026-05-08T00:00:00Z","modified":"2026-06-10T15:28:24.174Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400","CWE-670"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-28645","description":"Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_uploader/upload.py) trusts unsanitized, attacker-controlled upload parameters (e.g. flowTotalChunks) and does not enforce the documented max_file_size limit, allowing a remote, unauthenticated attacker to cause an out-of-memory (OOM) process crash (unbounded range(1, flowTotalChunks + 1) allocation), truncation of the target file to zero bytes (flowTotalChunks=0, where the all([]) == True quirk runs the file-assembly branch on zero chunks), permanent disk exhaustion (never-cleaned-up temporary directories per flowIdentifier), and a complete bypass of the documented max_file_size limit.","status":"published","published":"2026-05-08T00:00:00Z","modified":"2026-06-10T15:28:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:45.405546Z"}],"ghsa":[{"id":"GHSA-xp7f-v245-w3w8","title":"An issue in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute...","description":"An issue in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, dash_uploader/upload.py in the Upload function and max_file_size parameter, dash_uploader/configure_upload.py components","status":"published","published":"2026-05-08T15:31:25Z","modified":"2026-05-08T21:32:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:07:58.197878Z"}],"nvd":[{"id":"CVE-2026-38361","description":"Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_uploader/upload.py) trusts unsanitized, attacker-controlled upload parameters (e.g. flowTotalChunks) and does not enforce the documented max_file_size limit, allowing a remote, unauthenticated attacker to cause an out-of-memory (OOM) process crash (unbounded range(1, flowTotalChunks + 1) allocation), truncation of the target file to zero bytes (flowTotalChunks=0, where the all([]) == True quirk runs the file-assembly branch on zero chunks), permanent disk exhaustion (never-cleaned-up temporary directories per flowIdentifier), and a complete bypass of the documented max_file_size limit.","status":"published","published":"2026-05-08T15:16:37.12Z","modified":"2026-11-08T16:10:00.183Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-670"],"updated_at":"2026-11-08T18:10:35.805931Z"}],"osv":[{"id":"PYSEC-2026-37","description":"An issue in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, dash_uploader/upload.py in the Upload function and max_file_size parameter, dash_uploader/configure_upload.py components","status":"published","published":"2026-05-08T15:16:37.12Z","modified":"2026-05-20T09:18:56.225045Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:56.847083Z"}]}}