CVE-2026-38361 Denial of service in n/a
Unauthenticated attackers can cause out-of-memory crashes, file truncation, and disk exhaustion in dash-uploader by manipulating upload parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-38361?
CVE-2026-38361 is a high-severity denial of service vulnerability in n/a, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_uploader/upload.py) trusts unsanitized, attacker-controlled upload parameters (e.g. flowTotalChunks) and does not enforce the documented max_file_size limit, allowing a remote, unauthenticated attacker to cause an out-of-memory (OOM) process crash (unbounded range(1, flowTotalChunks + 1) allocation), truncation of the target file to zero bytes (flowTotalChunks=0, where the all([]) == True quirk runs the file-assembly branch on zero chunks), permanent disk exhaustion (never-cleaned-up temporary directories per flowIdentifier), and a complete bypass of the documented max_file_size limit.
Which versions are affected by CVE-2026-38361?
1 open source package ship an affected version, including dash-uploader. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dash-uploader PyPI | From 0.1.0 | 0.7.0a1 |
Products include Fohrloop Dash-Uploader.
How do I fix CVE-2026-38361?
Upgrade dash-uploader to 0.7.0a1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-38361 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-38361 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-xp7f-v245-w3w8, PYSEC-2026-37.