CVE-2026-48484: pyLoad Denial of Service Vulnerability Due to Lack of Input Size Validation
Summary
CVE-2026-48484: pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination. Affects pyload-ng versions < 0.5.0b3.dev101. Fixed in 0.5.0b3.dev101. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyLoad is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It supports multiple protocols and provides a web interface for easy access. However, it is vulnerable to a Denial of Service (DoS) attack due to improper handling of file uploads, which can lead to server memory exhaustion.
Vulnerability Detail
The vulnerability arises from the API 'rpc' function in api_blueprint.py, which processes 'multipart/form-data' uploads by reading the entire content of the uploaded file into memory without any size restrictions. This can lead to excessive memory consumption when large files are uploaded, potentially causing the server to crash or become unresponsive. The lack of input size validation allows an attacker to exploit this by uploading large files, resulting in Denial of Service (DoS) conditions.
How To Fix
Minimum fixed version
0.5.0b3.dev101
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the maximum size of uploaded files at the web server level. For example, in Nginx, you can add the following line to your server configuration: 'client_max_body_size 10M;'. This will restrict uploads to a maximum of 10 megabytes.
Conclusion
CVE-2026-48484 is a significant vulnerability in the pyLoad package that can lead to Denial of Service attacks due to improper handling of file uploads. It is crucial to update to the patched version and implement file size limits to mitigate this risk.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2026-48484 is a vulnerability in the pyLoad package that allows for Denial of Service (DoS) attacks due to a lack of input size validation during file uploads.
If you are using a version of pyload-ng prior to 0.5.0b3.dev101, your installation is vulnerable to this issue. You can check your version using 'pip show pyload-ng'.
The vulnerability can lead to Denial of Service (DoS) conditions, causing the pyLoad process to be killed by the operating system's Out-Of-Memory (OOM) killer, which may disrupt active downloads and tasks.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground.
The CVSS score for CVE-2026-48484 is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
