CVE-2026-48484: pyLoad Download Manager DOS Vulnerability

CVE-2026-48484 Overview

pyLoad is a free and open-source download manager written in Python. CVE-2026-48484 is a denial-of-service vulnerability affecting pyLoad versions prior to 0.5.0b3.dev101. The rpc API function in api_blueprint.py handles multipart/form-data uploads by reading the entire uploaded file into memory with file.read() before passing it to the underlying handler. Because no size limit is enforced at this stage, an authenticated attacker can submit a large file upload that exhausts available server memory and terminates the pyLoad process. The flaw is categorized under Improper Input Validation [CWE-20].

Critical Impact
Any authenticated user with API access can crash the pyLoad service by uploading a sufficiently large file, resulting in loss of availability.

Affected Products

pyLoad versions prior to 0.5.0b3.dev101
pyLoad Web UI API (api_blueprint.pyrpc endpoint)
Deployments exposing the pyLoad web interface to authenticated users

Discovery Timeline

2026-10-09 - CVE-2026-48484 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-48484

Vulnerability Analysis

The vulnerability resides in the rpc endpoint defined in src/pyload/webui/app/blueprints/api_blueprint.py. When the endpoint receives a multipart/form-data request, it calls file.read() to load the entire uploaded payload into a Python bytes object before invoking the underlying RPC handler. Flask does not impose a default upload size cap, so the handler accepts arbitrarily large payloads. An attacker holding valid credentials can send a single oversized upload, or many concurrent uploads, to allocate memory until the Python interpreter is terminated by the operating system. The EPSS score for this issue is 0.312%.

Root Cause

The root cause is missing input validation on request body size prior to buffering [CWE-20]. The rpc handler trusts client-supplied uploads and performs a full in-memory read without checking Content-Length, streaming the data, or applying a Flask MAX_CONTENT_LENGTH configuration value.

Attack Vector

Exploitation requires network access to the pyLoad web UI and low-privilege authenticated access. The attacker issues an HTTP POST to the rpc endpoint with a multipart/form-data body containing a large file. The server attempts to load the full payload into memory and is killed by the kernel OOM handler, interrupting active downloads and denying service to legitimate users.

python

     DEBUG = False
     TESTING = False
     SESSION_COOKIE_SAMESITE = "Lax"
+    MAX_CONTENT_LENGTH = 16 * 1024 * 1024  #: 16 Megabytes
     #: Extensions
     # BCRYPT_LOG_ROUNDS = 13
     # DEBUG_TB_ENABLED = False

Source: GitHub Commit 461cd66. The patch sets Flask's MAX_CONTENT_LENGTH to 16 MB in src/pyload/webui/app/config.py, causing Flask to reject oversized requests with HTTP 413 before the body is buffered.

Detection Methods for CVE-2026-48484

Indicators of Compromise

Abrupt termination of the pyLoad process with no corresponding shutdown command in application logs.
Operating system OOM-killer entries referencing the pyLoad Python process in dmesg or /var/log/messages.
HTTP POST requests to the rpc API endpoint with unusually large Content-Length values.

Detection Strategies

Monitor web server access logs for POST requests to rpc with Content-Length exceeding expected upload sizes.
Alert on repeated pyLoad process restarts or crash loops under supervisor, systemd, or container orchestrators.
Track resident memory of the pyLoad process and alert on rapid growth to near host limits.

Monitoring Recommendations

Enable verbose request logging on the reverse proxy fronting pyLoad to capture upload sizes and source IPs.
Correlate authentication events with large upload attempts to identify abusive accounts.
Forward host-level OOM events and systemd service-failure events to a central log platform for alerting.

How to Mitigate CVE-2026-48484

Immediate Actions Required

Upgrade pyLoad to version 0.5.0b3.dev101 or later, which enforces a 16 MB MAX_CONTENT_LENGTH.
Restrict network exposure of the pyLoad web UI to trusted users and networks only.
Rotate credentials for any accounts suspected of abusing the rpc upload endpoint.

Patch Information

The fix is published in commit 461cd66f30fa9e96453fb4d8c5c47467e452363c and tracked in GitHub Security Advisory GHSA-vq8p-m3wm-gv5f. The patch adds MAX_CONTENT_LENGTH = 16 * 1024 * 1024 to the Flask configuration, which causes Flask to reject oversized requests before they are read into memory.

Workarounds

Place pyLoad behind a reverse proxy such as nginx or Caddy and enforce a client_max_body_size limit well below host memory capacity.
Apply web application firewall rules to block POST requests to the rpc endpoint with Content-Length above an operational threshold.
Run pyLoad under a systemd unit or container with a hard memory limit so OOM events are contained and automatically restarted.

bash

# nginx reverse proxy configuration example
server {
    listen 443 ssl;
    server_name pyload.example.com;

    client_max_body_size 16M;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}