CVE-2026-48987 Details
Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client object to the clients list for each unique uuid submitted to the authenticated getEvents API endpoint, but get_events does not invoke the available clean method to remove inactive clients. An authenticated user can repeatedly submit unique UUID values, causing retained client objects and process memory to grow without bound even after requests stop. The resulting memory exhaustion can trigger an operating-system out-of-memory termination of pyLoad or host-wide instability and denial of service. This issue is fixed in version 0.5.0b3.dev101.
A denial-of-service vulnerability has been identified in pyLoad versions prior to 0.5.0b3.dev101. The issue arises in the EventManager module, which manages Client instances for event subscriptions. When unique UUIDs are submitted to the authenticated getEvents API, new Client instances are created and added to a list. However, the EventManager fails to invoke a clean-up method to remove inactive clients, leading to uncontrolled memory growth. This memory exhaustion can cause the pyLoad process to be terminated by the operating system or create host-wide instability.
Users can update to pyLoad version 0.5.0b3.dev101 or later, where this vulnerability has been fixed. Additionally, the EventManager can be modified to invoke the clean() method before processing new events, and rate limiting can be implemented on the getEvents endpoint to prevent abuse.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pyload/pyload/security/advisories/GHSA-c2f9-4mc8-j656 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pyload/pyload/commit/1b12dc7f348db8c144e0f39215680415e90ca4d2 | [email protected] | Source CodeVendor |
| https://github.com/pyload/pyload/security/advisories/GHSA-c2f9-4mc8-j656 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pyLoad | < 0.5.0b3.dev100 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | New CVE Received | [email protected] |
| Sep 15, 2026 | CVE Modified | CISA-ADP |