CVE-2026-48484

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-48484

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48484.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-48484

Aliases

Published

2026-10-09T16:26:37Z

Modified

2026-10-15T14:56:20Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Details

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in api_blueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read(). This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-20",
        "CWE-400"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48484.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "0.5.0b3.dev101"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/pyload/pyload

Affected ranges

Type

GIT

Repo

https://github.com/pyload/pyload

Events

Introduced

Fixed

461cd66f30fa9e96453fb4d8c5c47467e452363c

Database specific

Show details

{
    "source":  "REFERENCES"
}

Affected versions

v0.*

v0.1

v0.1.1

v0.2

v0.2.1

v0.2.2

v0.3

v0.3.1

v0.3.2

v0.4

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48484.json"