Read the docs
TI-2026-36243 Aliases CVE-2026-48987GHSA-c2f9-4mc8-j656

pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

Priority MEDIUM 62CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client object to the clients list for each unique uuid submitted to the authenticated getEvents API endpoint, but get_events does not invoke the available clean method to remove inactive clients. An authenticated user can repeatedly submit unique UUID values, causing retained client objects and process memory to grow without bound even after requests stop. The resulting memory exhaustion can trigger an operating-system out-of-memory termination of pyLoad or host-wide instability and denial of service. This issue is fixed in version 0.5.0b3.dev101.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix Fixed pyload (pyload): 0.5.0b3.dev101

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyloadpyloadbefore 0.5.0b3.dev1010.5.0b3.dev101Patch availableCNA
—pyload-ng (PyPI)up to 0.5.0b3.dev100—No fix listedGHSA-c2f9-4mc8-j656
  • pyload Vendorpyload Affected before 0.5.0b3.dev101 Fixed in 0.5.0b3.dev101 Patch available CNA
  • pyload-ng (PyPI) Vendor— Affected up to 0.5.0b3.dev100 Fixed in — No fix listed GHSA-c2f9-4mc8-j656

Remediation

  • Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev101

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48987
  2. 2026-10-03 Alias added: GHSA-c2f9-4mc8-j656

References

Other 3

  • TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2025-34556 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
  • TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
  • TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
  • TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences