Advisory details:
pypa / pyload-ng/PYSEC-2026-4293
| Advisory ID | pypa/pyload-ng/PYSEC-2026-4293 |
| Aliases |
CVE-2026-48484
GHSA-vq8p-m3wm-gv5f PYSEC-2026-4293 |
| Summary | pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination ## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. ## VulnerableCode & Path: https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73 ## Steps to Reproduce: 1. Log in to pyLoad (or use an API key, here i used api to communicate). 2. Prepare a large file (e.g., 10GB) . ```bash truncate -s 10G large_file.bin ``` 3. Send a multipart request to an API function that accepts a file, such as `check_online_status_container`: ```bash curl -X POST "http://localhost:8000/api/rpc" \ -H "X-API-Key: YOUR_API_KEY" \ -F "func=check_online_status_container" \ -F "container=@large_file.bin" ``` 4. Monitor the server's memory usage. The process will attempt to allocate memory for the entire file and last the process will be killed by the kernel. <img width="1902" height="610" alt="dos-process-kill-poc" src="https://github.com/user-attachments/assets/2b9bfd0f-5b9f-48dd-983f-f97dfcc358cc" /> ## Impact - **Denial of Service (DoS)**: The pyLoad process will be killed by the Operating System's Out-Of-Memory (OOM) killer, or the entire system may become unresponsive due to swap thrashing or memory exhaustion. - **Service Instability**: Any active downloads or tasks will be interrupted. ## Mitigations - **Implement File Size Limits**: Enforce a maximum size for uploaded files in the web server configuration (e.g., Nginx `client_max_body_size`). |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.9 |
| Risk | 3.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 6.5 | https://github.com/pypa/advisory-database/blob/main/vulns/pyload-ng/PYSEC-2026-4293.yaml |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.