CVE-2025-57751: pyLoad Download Manager DoS Vulnerability

CVE-2025-57751 Overview

CVE-2025-57751 is a resource exhaustion vulnerability in pyLoad, the open-source download manager written in Python. The flaw resides in the CNL (Click'n'Load) Blueprint, which accepts a jk parameter from user input. Because pyLoad does not validate the jk parameter before passing it to dykpy.evaljs(), an attacker can submit a request that forces the server to execute expensive JavaScript evaluation. The result is full CPU consumption and an unresponsive web interface. The vulnerability is fixed in pyLoad version 0.5.0b3.dev92. The issue is tracked under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated network attackers can fully saturate the pyLoad server CPU and render the web UI unresponsive by submitting a crafted jk parameter to the CNL endpoint.

Affected Products

pyLoad Download Manager versions prior to 0.5.0b3.dev92
pyLoad CNL Blueprint component
Self-hosted pyLoad instances exposing the web UI to untrusted networks

Discovery Timeline

2025-08-21 - CVE-2025-57751 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-57751

Vulnerability Analysis

pyLoad exposes a CNL (Click'n'Load) Blueprint endpoint that accepts a jk parameter from client requests. The CNL protocol traditionally carries an encryption key and a small JavaScript snippet used to derive that key. pyLoad processes this snippet by invoking dykpy.evaljs(), which executes the supplied JavaScript inside an embedded interpreter. The handler accepts whatever value the client supplies in jk and passes it directly to the evaluator. An attacker can supply a JavaScript payload that consumes large amounts of CPU time, such as a tight loop or an algorithmically complex computation. The evaluation occupies a worker thread until the runtime completes, and repeated requests compound the load until the web UI becomes unresponsive.

Root Cause

The root cause is missing input validation on the jk parameter. The CNL handler does not constrain the structure, size, or runtime cost of the JavaScript before dispatching it to dykpy.evaljs(). No execution timeout, rate limit, or syntactic filter is applied. Any value the client supplies is treated as trusted JavaScript and executed inside the server process, satisfying the conditions described by CWE-400.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the CNL endpoint over HTTP and submits a request containing a malicious jk value. The server invokes dykpy.evaljs() on the payload, and CPU consumption rises immediately. Multiple parallel requests amplify the effect and prevent legitimate users from interacting with the web UI. The advisory and patch details are available in the pyLoad GitHub Security Advisory GHSA-9gjj-6gj7-c4wj.

Detection Methods for CVE-2025-57751

Indicators of Compromise

Sustained CPU saturation on the pyLoad host process without a corresponding download workload
HTTP requests to the CNL Blueprint endpoint containing unusually large or computationally expensive jk parameter values
Web UI becoming unresponsive while the pyLoad process remains running
Repeated CNL requests originating from a single source IP within a short window

Detection Strategies

Inspect web server access logs for POST or GET requests targeting CNL routes that include a jk parameter exceeding expected length
Correlate process-level CPU spikes on the pyLoad host with inbound HTTP traffic to identify request-driven exhaustion
Apply web application firewall rules that flag JavaScript control-flow keywords such as while, for, or recursive constructs inside the jk field

Monitoring Recommendations

Alert when the pyLoad process exceeds a CPU utilization threshold for longer than a defined interval
Monitor HTTP response latency on the pyLoad web UI to identify degradation before users report outages
Track request rates to CNL endpoints and alert on volumetric anomalies from individual clients

How to Mitigate CVE-2025-57751

Immediate Actions Required

Upgrade pyLoad to version 0.5.0b3.dev92 or later, which contains the official fix
Restrict network access to the pyLoad web UI so only trusted hosts can reach CNL endpoints
Place pyLoad behind a reverse proxy that enforces rate limits and request size caps on the jk parameter

Patch Information

The maintainers fixed the vulnerability in pyLoad 0.5.0b3.dev92 by adding verification of the jk parameter before it is passed to dykpy.evaljs(). Administrators running earlier builds should update from the pyLoad GitHub Security Advisory GHSA-9gjj-6gj7-c4wj and confirm the running version after upgrade.

Workarounds

Bind the pyLoad listener to 127.0.0.1 and require an authenticated VPN or SSH tunnel for access
Use reverse proxy rules to block requests where the jk parameter exceeds a small byte limit or contains JavaScript loop constructs
Apply per-source rate limiting to CNL endpoints to slow exhaustion attempts

bash

# Example nginx reverse proxy hardening for pyLoad CNL endpoint
limit_req_zone $binary_remote_addr zone=pyload_cnl:10m rate=5r/m;

server {
    listen 443 ssl;
    server_name pyload.internal.example;

    location /flash/ {
        limit_req zone=pyload_cnl burst=5 nodelay;
        client_max_body_size 4k;
        proxy_pass http://127.0.0.1:8000;
    }
}