CVE-2025-57751 — Uncontrolled Resource Consumption in Pyload

CWE-400 — Uncontrolled Resource Consumption4 documents4 sources
Severity
7.7HIGHNVD
EPSS
0.1%
top 78.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PyloadPyload-ng Project Pyload-ng
Timeline
PublishedAug 21

Description

pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5pyload/pyload< 0.5.0b3.dev92
▶PyPIpyload-ng_project/pyload-ng< 0.5.0b3.dev92

🔴Vulnerability Details

3
OSV
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs↗2025-08-21
▶
CVEList
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs↗2025-08-21
▶
GHSA
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs↗2025-08-21
▶
CVE-2025-57751 — Uncontrolled Resource Consumption | cvebase