CVE-2026-38361: Fohrloop Dash-uploader RCE Vulnerability

CVE-2026-38361 Overview

CVE-2026-38361 affects the fohrloop dash-uploader Python package, versions 0.1.0 through 0.7.0a2. The vulnerability resides in the dash_uploader/httprequesthandler.py, dash_uploader/upload.py, and dash_uploader/configure_upload.py components. A remote attacker can abuse the Upload function and the max_file_size parameter to trigger uncontrolled resource consumption [CWE-400]. The flaw is reachable over the network without authentication or user interaction, making any exposed Dash application that integrates dash-uploader a viable target for availability attacks.

Critical Impact
An unauthenticated remote attacker can exhaust server resources and crash Dash applications that use dash-uploader for file uploads, resulting in denial of service.

Affected Products

fohrloop dash-uploader v0.1.0 through v0.7.0
fohrloop dash-uploader v0.7.0 alpha1
fohrloop dash-uploader v0.7.0 alpha2

Discovery Timeline

2026-05-08 - CVE-2026-38361 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-38361

Vulnerability Analysis

The dash-uploader package provides a large file upload component for Plotly Dash applications. The vulnerability is classified as Uncontrolled Resource Consumption [CWE-400]. The affected components — httprequesthandler.py, upload.py, and configure_upload.py — handle incoming HTTP upload requests and enforce upload sizing through the max_file_size parameter. An attacker can submit requests that bypass or stress these size enforcement paths, causing the server to allocate excessive memory or disk resources while processing the upload stream.

Because the flaw affects availability without compromising confidentiality or integrity, exploitation results in service disruption rather than code execution, despite the NVD description language. The EPSS score is 0.744% (73.2 percentile), indicating modestly elevated exploitation interest relative to typical CVEs.

Root Cause

The root cause is insufficient validation and bounding within the upload request handling logic. The max_file_size parameter and related size checks in the request handler do not effectively constrain server-side resource allocation during streamed multipart uploads. See the GitHub Dash Uploader Issue Tracker and the GitHub Dash Uploader Source Code for component-level context.

Attack Vector

The attack is performed over the network against the HTTP endpoint exposed by a Dash application embedding the du.Upload component. An unauthenticated attacker issues crafted upload requests that drive the server to consume CPU, memory, or storage beyond intended limits. Repeated or concurrent requests amplify the effect and can render the Dash application unresponsive. Refer to the GitHub CVE-2026-38361 Repository for additional research context.

Detection Methods for CVE-2026-38361

Indicators of Compromise

Sustained spikes in memory or disk usage on hosts running Dash applications with dash-uploader installed.
Repeated HTTP POST or PATCH requests to upload endpoints handled by httprequesthandler.py from a single source.
Worker process restarts, OOM-killer events, or 5xx responses correlated with upload traffic.

Detection Strategies

Inventory Python environments for dash-uploader installations in the 0.1.0 through 0.7.0a2 range using pip list or SBOM tooling.
Inspect web server and application logs for abnormally large or long-running upload sessions to Dash routes.
Correlate WAF or reverse proxy telemetry with backend resource metrics to identify upload-driven exhaustion patterns.

Monitoring Recommendations

Alert on memory utilization thresholds and process restarts for Dash worker processes.
Track request rate, payload size, and connection duration per source IP against upload endpoints.
Forward application and host telemetry to a centralized analytics platform for correlation against the indicators above.

How to Mitigate CVE-2026-38361

Immediate Actions Required

Identify all Dash applications that import dash_uploader and confirm the installed version.
Restrict access to upload endpoints to authenticated users and trusted networks until a patched release is deployed.
Place a reverse proxy or WAF in front of affected applications to enforce strict request size and rate limits.

Patch Information

No fixed version is listed in the NVD record at the time of publication. Track the GitHub Dash Uploader Project and the PyPI Dash Uploader Package for an updated release that addresses the resource consumption issue, and review the GitHub Dash Uploader Issue Tracker for remediation status.

Workarounds

Enforce upload size limits at the reverse proxy layer (for example, client_max_body_size in NGINX) instead of relying on max_file_size alone.
Apply per-IP rate limiting and concurrent connection caps to upload routes.
Run Dash worker processes with memory cgroup limits to contain resource exhaustion blast radius.
Disable or remove the dash-uploader component from production deployments that do not require upload functionality.

bash

# NGINX example: bound upload size and rate-limit upload endpoint
http {
    limit_req_zone $binary_remote_addr zone=uploads:10m rate=5r/s;

    server {
        client_max_body_size 50m;
        client_body_timeout 30s;

        location /_dash-upload {
            limit_req zone=uploads burst=10 nodelay;
            limit_conn_status 429;
            proxy_pass http://dash_backend;
        }
    }
}