CVE-2026-109967: yt-dlp-web-ui DOS Vulnerability

CVE-2026-109967 Overview

CVE-2026-109967 is a NULL pointer dereference vulnerability [CWE-476] in yt-dlp-web-ui through version 4.0.0. The flaw resides in the Service.Formats JSON-RPC method and allows remote, unauthenticated attackers to crash the server process. An attacker sends a single JSON-RPC request with a crafted url value such as --version, which causes yt-dlp to emit invalid JSON. The parser does not handle the malformed output, triggering an unrecovered panic that terminates the server.

Critical Impact
A single unauthenticated network request terminates the yt-dlp-web-ui process, resulting in a denial-of-service condition against any exposed instance.

Affected Products

yt-dlp-web-ui through version 4.0.0
server/rpc/service.go component (Service.Formats method)
server/formats/parser.go component

Discovery Timeline

2026-10-13 - CVE-2026-109967 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109967

Vulnerability Analysis

The Service.Formats JSON-RPC method in yt-dlp-web-ui passes a user-supplied url parameter directly to the yt-dlp command-line tool. When the attacker provides a value that yt-dlp interprets as a flag (such as --version) instead of a URL, yt-dlp returns output that is not valid JSON. The parser in server/formats/parser.go attempts to dereference a pointer that was never populated by the failed JSON unmarshal. This produces a nil pointer dereference and triggers a Go runtime panic. Because the panic is not recovered by the RPC handler, the entire server process exits.

Root Cause

The root cause is twofold. First, the url argument is not validated before being forwarded to yt-dlp, which allows argument injection into the subprocess invocation. Second, the parser assumes that yt-dlp always returns well-formed JSON and does not check whether unmarshaling succeeded before dereferencing the result pointer. The RPC service layer also lacks a recover() guard, so a panic in any single request takes down the entire daemon.

Attack Vector

Exploitation requires only network access to the JSON-RPC endpoint. No authentication, user interaction, or prior reconnaissance is needed. The attacker submits a single JSON-RPC call targeting Service.Formats and supplies a url value that yt-dlp treats as a CLI flag. The subprocess exits with non-JSON output, the parser dereferences a nil pointer, and the server terminates. Any publicly reachable deployment can be taken offline repeatedly by looping the request.

No verified exploitation code is available. See the VulnCheck Advisory and the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-109967

Indicators of Compromise

Unexpected termination of the yt-dlp-web-ui process accompanied by a Go runtime panic stack trace referencing server/formats/parser.go.
JSON-RPC requests to the Service.Formats method containing url values that begin with - or --, such as --version, --help, or other yt-dlp CLI flags.
Repeated short-lived process restarts logged by the service manager (systemd, Docker, or supervisor) shortly after inbound RPC traffic.

Detection Strategies

Inspect HTTP request bodies destined for the JSON-RPC endpoint and alert on method values of Service.Formats where the url parameter does not match a valid URL pattern.
Correlate process exit events for the yt-dlp-web-ui binary with preceding inbound network connections to identify DoS attempts.
Enable structured application logging and alert on Go panic signatures emitted to stderr during RPC handling.

Monitoring Recommendations

Track service availability and restart counts for yt-dlp-web-ui using health checks and alert on abnormal restart frequency.
Forward application and container stdout/stderr to a centralized logging platform to retain panic traces for forensic review.
Monitor ingress traffic to the RPC port for unauthenticated requests originating from untrusted networks.

How to Mitigate CVE-2026-109967

Immediate Actions Required

Restrict network exposure of the yt-dlp-web-ui RPC endpoint by binding it to localhost or placing it behind an authenticated reverse proxy.
Enforce authentication on the JSON-RPC endpoint using a reverse proxy such as nginx or Caddy with HTTP Basic Auth or mTLS.
Filter inbound request bodies at a web application firewall to reject Service.Formats requests where the url parameter begins with a dash character.

Patch Information

No patched release is referenced in the published advisory. All versions through 4.0.0 are affected. Monitor the GitHub Project Repository for a fixed release and apply it as soon as it is published. Review the vulnerable code paths in server/rpc/service.go and server/formats/parser.go when evaluating any backported patch.

Workarounds

Place the service behind a reverse proxy that validates the url field against a strict URL schema before forwarding requests.
Run yt-dlp-web-ui under a process supervisor configured to automatically restart on panic to reduce downtime while a patch is pending.
Block all external access to the RPC port using host-based firewall rules such as iptables or cloud security group policies.
Rate-limit requests to the JSON-RPC endpoint to slow repeated DoS attempts from a single source.

bash

# Example: restrict yt-dlp-web-ui to localhost and front with authenticated nginx
# Bind the service to loopback only, then proxy with auth and input validation
location /rpc {
    auth_basic "restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    if ($request_body ~* "\"url\"\s*:\s*\"-") { return 400; }
    proxy_pass http://127.0.0.1:3033;
}