CVE-2026-48484 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
Attackers can crash the pyLoad download manager by uploading large files, exhausting server memory due to missing input size validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48484?
CVE-2026-48484 is a medium-severity denial of service vulnerability in pyload, published on 9 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.
Which versions are affected by CVE-2026-48484?
3 open source packages ship an affected version, including pyload-ng.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions | 0.5.0b3.dev101 |
pyload-ng PyPI | All versions | 0.5.0b3.dev101 |
pyload-ng PyPI | All versions | 0.5.0b3.dev101 |
How do I fix CVE-2026-48484?
Upgrade pyload-ng to 0.5.0b3.dev101 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48484 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48484 exists.
Sources
Also known as GHSA-vq8p-m3wm-gv5f, PYSEC-2026-4293.