https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 02:50:51 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-385186 EUVD-2026-385186 https://cve.radiocsirt.org/vuln/euvd-2026-385186 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48484 <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server&#39;s available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.</p> <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server&#39;s available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48484 https://cve.radiocsirt.org/vuln/ghsa-vq8p-m3wm-gv5f <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server&#39;s available memory which led to process termination.</p> <p>## VulnerableCode &amp; Path: https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73</p> <p>## Steps to Reproduce: 1. Log in to pyLoad (or use an API key, here i used api to communicate). 2. Prepare a large file (e.g., 10GB) . ```bash truncate -s 10G large_file.bin ``` 3. Send a multipart request to an API function that accepts a file, such as `check_online_status_container`: ```bash curl -X POST &#34;http://localhost:8000/api/rpc&#34; \ -H &#34;X-API-Key: YOUR_API_KEY&#34; \ -F &#34;func=check_online_status_container&#34; \ -F &#34;container=@large_file.bin&#34; ``` 4. Monitor the server&#39;s memory usage. The process will attempt to allocate memory for the entire file and last the process will be killed by the kernel. &lt;img width=&#34;1902&#34; height=&#34;610&#34; alt=&#34;dos-process-kill-poc&#34; src=&#34;https://github.com/user-attachments/assets/2b9bfd0f-5b9f-48dd-983f-f97dfcc358cc&#34; /&gt;</p> <p>## Impact - **Denial of Service (DoS)**: The pyLoad process will be killed by the Operating System&#39;s Out-Of-Memory (OOM) killer, or the entire system may become unresponsive due…</p> <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server&#39;s available memory which led to process termination.</p> <p>## VulnerableCode &amp; Path: https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73</p> <p>## Steps to Reproduce: 1. Log in to pyLoad (or use an API key, here i used api to communicate). 2. Prepare a large file (e.g., 10GB) . ```bash truncate -s 10G large_file.bin ``` 3. Send a multipart request to an API function that accepts a file, such as `check_online_status_container`: ```bash curl -X POST &#34;http://localhost:8000/api/rpc&#34; \ -H &#34;X-API-Key: YOUR_API_KEY&#34; \ -F &#34;func=check_online_status_container&#34; \ -F &#34;container=@large_file.bin&#34; ``` 4. Monitor the server&#39;s memory usage. The process will attempt to allocate memory for the entire file and last the process will be killed by the kernel. &lt;img width=&#34;1902&#34; height=&#34;610&#34; alt=&#34;dos-process-kill-poc&#34; src=&#34;https://github.com/user-attachments/assets/2b9bfd0f-5b9f-48dd-983f-f97dfcc358cc&#34; /&gt;</p> <p>## Impact - **Denial of Service (DoS)**: The pyLoad process will be killed by the Operating System&#39;s Out-Of-Memory (OOM) killer, or the entire system may become unresponsive due…</p> https://cve.radiocsirt.org/vuln/ghsa-vq8p-m3wm-gv5f