CVE-2026-48484
published 2026-10-09CVE-2026-48484: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.31%
22.9th percentile
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pyload-ng_project | pyload-ng | >= 0 < 0.5.0b3.dev101 | 0.5.0b3.dev101 |
| pyload | pyload | < 0.5.0b3.dev101 | 0.5.0b3.dev101 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
ghsa·2026-10-09
CVE-2026-48484 [MEDIUM] CWE-20 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
## Description:
The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination.
## VulnerableCode & Path:
https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73
## Steps to Reproduce:
1. Log in to pyLoad (or use an API key, here i used api to communicate).
2. Prepare a large file (e.g., 10GB) .
```bash
truncate -s
VulDB
pyLoad up to 0.5.0b3.dev100 API api_blueprint.py rpc input validation
vuldb·2026-10-09·CVSS 6.5
CVE-2026-48484 [MEDIUM] pyLoad up to 0.5.0b3.dev100 API api_blueprint.py rpc input validation
A vulnerability described as problematic has been identified in pyLoad. Affected by this issue is the function rpc of the file api_blueprint.py of the component API. Executing a manipulation can lead to improper input validation.
This vulnerability is handled as CVE-2026-48484. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73https://github.com/pyload/pyload/commit/461cd66f30fa9e96453fb4d8c5c47467e452363chttps://github.com/pyload/pyload/security/advisories/GHSA-vq8p-m3wm-gv5fhttps://github.com/pyload/pyload/security/advisories/GHSA-vq8p-m3wm-gv5f
2026-10-09
Published