Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-48484 · GHSA-vq8p-m3wm-gv5f

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Risk score
49/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in api_blueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read(). This occurs before the data is sent to the underlying function. Sinc…
Affected
pyload-ng (pip) < 0.5.0b3.dev101
Fix
Upgrade pyload-ng to 0.5.0b3.dev101 or later.
Exploitation
No known exploitation

Story map

Story map: pyload-ngTHE FLAWSTHE FIXCVE-2026-48484PyLoad: Lack of Input SizeValidation Leads to Denial ofService (DoS) and Process…CVSS 6.5 · EPSS 0%GHSA-68w4-83fh-f2w8GetUserData/get_userdataexposed at Perms.ANY allowany authenticated account to…CVSS 8.1GHSA-r44w-v6gf-x3p6PyLoad has an authenticationbypass in API key validation(check_apikey cache)CVSS 8.1GHSA-9q47-3cm2-2rp8PyLoad: Rate-Limit Bypass andAudit-Log Spoofing via TrustedClient-Controlled…CVSS 6.9Upgrade pyload-ng0.5.0or later on your release lineWho is exposedpyload-ng (pip) >= 0.5.0b3.dev1,<= 0.5.0b3.dev101YELLOW · PLAN IT INpyload-ngApi.getUserData (legacy) andApi.get_userdata are declaredwith @permission(Perms.ANY)and are reachable at/api/getUserData and/api/get_userdata. BecausePerms.ANY == 0 and pyLoad's…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-400)253 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

pyload-ng: Yellow, plan it in. Api.getUserData (legacy) and Api.get_userdata are declared with @permission(Perms.ANY) and are reachable at /api/getUserData and /api/get_userdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one holding zero permission bits…

The flaws

  • CVE-2026-48484: PyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination (CVSS 6.5 · EPSS 0%)
  • GHSA-68w4-83fh-f2w8: GetUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password (CVSS 8.1)
  • GHSA-r44w-v6gf-x3p6: PyLoad has an authentication bypass in API key validation (check_apikey cache) (CVSS 8.1)
  • GHSA-9q47-3cm2-2rp8: PyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header (CVSS 6.9)

The fix

Upgrade pyload-ng: 0.5.0 or later on your release line

Who is exposed: pyload-ng (pip) >= 0.5.0b3.dev1, <= 0.5.0b3.dev101

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
pyload-ngpip< 0.5.0b3.dev1010.5.0b3.dev101

References

Original description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.

Last activity 9 Oct 2026. Patch Forecast updates every hour.