Read the docs
TI-2026-70045 Aliases CVE-2026-48484GHSA-vq8p-m3wm-gv5f

pyLoad API uploads can exhaust memory and terminate the process

Priority MEDIUM 62CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

pyLoad, a Python download manager, is affected before 0.5.0b3.dev101 in the pyload and pyload-ng packages. The API rpc function reads entire multipart/form-data uploads into memory without any size limit, which is CWE-400 (uncontrolled resource consumption). A remote attacker with low privileges can send a large file upload to exhaust server memory and terminate the process.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00371 31st percentileScored 2026-11-07
Fix Fixed pyload (pyload): 0.5.0b3.dev101pyload-ng (PyPI): 0.5.0b3.dev101

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyloadpyloadbefore 0.5.0b3.dev1010.5.0b3.dev101Patch availableCNA
—pyload-ng (PyPI)before 0.5.0b3.dev1010.5.0b3.dev101Patch availableGHSA-vq8p-m3wm-gv5f
  • pyload Vendorpyload Affected before 0.5.0b3.dev101 Fixed in 0.5.0b3.dev101 Patch available CNA
  • pyload-ng (PyPI) Vendor— Affected before 0.5.0b3.dev101 Fixed in 0.5.0b3.dev101 Patch available GHSA-vq8p-m3wm-gv5f

Remediation

Upgrade pyload-ng to 0.5.0b3.dev101, which contains the patch. The sources list no fixed version for pyload.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev101
  • Fix · GHSA-vq8p-m3wm-gv5f pyload-ng (PyPI) Fixed in 0.5.0b3.dev101 Advisory →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-48484
  2. 2026-10-09 Alias added: GHSA-vq8p-m3wm-gv5f
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-14 CISA SSVC decision points changed
  5. 2026-10-14 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2025-34556 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
  • TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
  • TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
  • TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences