CVE-2026-90928: File Browser Memory Exhaustion DoS Flaw

CVE-2026-90928 Overview

CVE-2026-90928 is a memory exhaustion vulnerability affecting File Browser through version 2.63.23. The flaw resides in the subtitle conversion endpoint, which loads entire subtitle files into memory without enforcing size limits. Authenticated attackers holding download permission can submit large .srt, .ass, or .ssa files for conversion. Concurrent requests amplify memory consumption and force the server into a denial-of-service condition. The vulnerability is tracked under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Authenticated users with download permission can exhaust server memory and cause denial of service by submitting oversized subtitle files to the conversion endpoint.

Affected Products

File Browser versions through 2.63.23
Subtitle conversion endpoint handling .srt, .ass, and .ssa formats
Deployments exposing the File Browser web interface to authenticated users

Discovery Timeline

2026-09-14 - CVE-2026-90928 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90928

Vulnerability Analysis

File Browser exposes a subtitle conversion endpoint that reads user-provided subtitle files fully into memory before processing. The handler does not validate or cap the input file size prior to buffering. An authenticated attacker with the download role can upload or reference large .srt, .ass, or .ssa files and issue conversion requests. Because each request allocates memory proportional to the input, parallel requests multiply the memory pressure on the server process. The condition maps to [CWE-400: Uncontrolled Resource Consumption] and results in denial of service against the File Browser instance.

Root Cause

The subtitle conversion routine loads the entire file contents into memory without applying a maximum size threshold or streaming the input. Missing bounds checks combined with the absence of per-user or global concurrency limits allow small numbers of authenticated requests to consume disproportionate resources.

Attack Vector

Exploitation requires network reachability to the File Browser HTTP interface and valid credentials with download permission. The attacker submits concurrent conversion requests referencing oversized subtitle files. Sustained requests drive the process to exhaust available memory and terminate or become unresponsive. Additional technical detail is available in the GitHub Security Advisory GHSA-448h-jr2h-3vhp and the VulnCheck Memory Exhaustion Advisory.

Detection Methods for CVE-2026-90928

Indicators of Compromise

Repeated HTTP requests to the File Browser subtitle conversion endpoint from a single authenticated session
Uploads or references to unusually large .srt, .ass, or .ssa files
File Browser process memory growth followed by out-of-memory termination or restarts
Sudden spikes in concurrent requests from accounts holding only download permission

Detection Strategies

Alert on HTTP request bursts targeting subtitle conversion routes within short time windows
Correlate authenticated session identifiers with abnormal request volume against media-processing endpoints
Track process resident set size (RSS) for the File Browser service and trigger on sustained upward trends

Monitoring Recommendations

Enable verbose access logging on the File Browser reverse proxy and retain request size and duration fields
Forward host memory metrics and application logs to a centralized analytics platform for baseline comparison
Review accounts with download permission on a recurring cadence and remove unused entitlements

How to Mitigate CVE-2026-90928

Immediate Actions Required

Restrict access to the File Browser instance to trusted networks until a fixed release is deployed
Audit accounts holding download permission and revoke access for non-essential users
Place a reverse proxy in front of File Browser to enforce request size limits and rate limiting on subtitle endpoints

Patch Information

Refer to the GitHub Security Advisory GHSA-448h-jr2h-3vhp for upstream remediation guidance. Upgrade File Browser to a release later than 2.63.23 once available and validate that the subtitle conversion handler enforces size limits.

Workarounds

Configure the upstream reverse proxy (for example, Nginx or Traefik) to cap request body size on subtitle conversion routes
Apply per-source rate limits to the subtitle endpoint to prevent concurrent large-file processing
Disable subtitle conversion functionality if it is not required in the deployment
Constrain the File Browser container with memory limits so exhaustion is contained to the workload

bash

# Example Nginx configuration to cap subtitle conversion request size and rate
limit_req_zone $binary_remote_addr zone=subtitle:10m rate=5r/m;

location ~* /api/subtitles/ {
    client_max_body_size 1m;
    limit_req zone=subtitle burst=2 nodelay;
    proxy_pass http://filebrowser_backend;
}