CVE-2026-48484 Details
Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.
A denial-of-service vulnerability has been identified in pyLoad versions prior to 0.5.0b3.dev101. The issue arises in the API 'rpc' function within 'api_blueprint.py', where 'multipart/form-data' uploads are handled by reading the entire content of the uploaded file into memory without any size limit. This can lead to excessive memory consumption, causing the server process to be terminated. The vulnerability disrupts active downloads and tasks, and can cause the entire system to become unresponsive due to memory exhaustion.
Users can update to pyLoad version 0.5.0b3.dev101 or later, where this vulnerability has been patched. Additionally, it is recommended to implement file size limits in the web server configuration to prevent large file uploads from causing memory exhaustion.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pyload/pyload/security/advisories/GHSA-vq8p-m3wm-gv5f | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73 | [email protected] | Source CodeVendor |
| https://github.com/pyload/pyload/commit/461cd66f30fa9e96453fb4d8c5c47467e452363c | [email protected] | Source CodeVendor |
| https://github.com/pyload/pyload/security/advisories/GHSA-vq8p-m3wm-gv5f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pyLoad | < 0.5.0b3.dev100 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |