Disclosure summary
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.
Source-reported weakness categories
CWE-20, CWE-400
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-48484
Open original source · Updated Oct 09, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
GitHub Reviewed Security Advisories · GHSA-vq8p-m3wm-gv5f
Open original source · Updated Oct 09, 2026
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
Source severity: MEDIUM / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| pip | pyload-ng | < 0.5.0b3.dev101 | 0.5.0b3.dev101 |
Original records & references
PUBLISHED 2026-10-09T13:16:47-04:00
MODIFIED 2026-10-09T13:16:47-04:00
INGESTED 2026-10-10T20:55:12-04:00