CVE-2026-48987

Memory exhaustion DoS via unbounded client list growth in pyLoad event API.

• CVSS 6.5
• 400
• Resource Management
• Remote

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client object to the clients list for each unique uuid submitted to the authenticated getEvents API endpoint, but get_events does not invoke the available clean method to remove inactive clients. An authenticated user can repeatedly submit unique UUID values, causing retained client objects and process memory to grow without bound even after requests stop. The resulting memory exhaustion can trigger an operating-system out-of-memory termination of pyLoad or host-wide instability and denial of service. This issue is fixed in version 0.5.0b3.dev101.

CVE

CVE-2026-48987

CWE

400

CVSS base score

6.5

Published

2026-09-15

OWASP

A04 Insecure Design

Orthogonal defect classification

Assignment

Code defect classification

Missing Check

Category

Resource Management

Subcategory

Memory Leaks

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

pyLoad

Fixed by upgrading

Yes

Solution

Upgrade pyLoad to version 0.5.0b3.dev101 or later.

class Client:
    def __init__(self, uuid):
        self.uuid = uuid
        self.active = True

class EventManager:
    def __init__(self):
        self.clients = []

    # VULNERABLE: retains client objects for each UUID without cleanup
    def get_events(self, uuid):
        client = Client(uuid)
        self.clients.append(client)
        # ...process events...
        return {"status": "ok"}

    def clean(self):
        # Remove inactive clients
        self.clients = [c for c in self.clients if c.active]

class Client:
    def __init__(self, uuid):
        self.uuid = uuid
        self.active = True

class EventManager:
    def __init__(self):
        self.clients = []

    # FIX: invoke cleanup before adding new client to avoid memory leak
    def get_events(self, uuid):
        self.clean()
        client = Client(uuid)
        self.clients.append(client)
        # ...process events...
        return {"status": "ok"}

    def clean(self):
        # Remove inactive clients
        self.clients = [c for c in self.clients if c.active]

@misc{vaitp:cve202648987,
  title        = {{Memory exhaustion DoS via unbounded client list growth in pyLoad event API.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-48987},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-48987/}}
}