CVE-2026-109967

Deferred Deferred - Pending Action

NULL Pointer Dereference in yt-dlp-web-ui

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109967

EUVD

EUVD-2026-98693

Affected Vendors & Products

Vendor	Product	Version / Range
marcopiovanello	yt-dlp-web-ui	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

yt-dlp-web-ui through version 4.0.0 has a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method. Attackers can send a crafted request with a URL like --version, causing invalid yt-dlp JSON output. This triggers an unrecovered panic that crashes the server process.

Detection Guidance

To detect this vulnerability, monitor for crashes in yt-dlp-web-ui processes after receiving JSON-RPC requests with URLs starting with hyphens like --version. Check server logs for panic errors or process termination in the RPC service. Use network traffic analysis to identify unauthenticated requests to /rpc/http or /rpc/ws endpoints.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to crash the yt-dlp-web-ui server by sending a single malicious request. The server downtime could disrupt video downloads, livestream monitoring, and other services relying on the RPC interface.

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) via server crashes, which may disrupt availability of services handling personal or sensitive data. While not directly violating GDPR or HIPAA, prolonged downtime could impact compliance with availability requirements under these regulations. No evidence suggests data exfiltration or unauthorized access, but service disruption may affect audit logging or timely data processing.

Mitigation Strategies

Immediately disable or block access to the JSON-RPC endpoints (/rpc/http and /rpc/ws) if possible. Update firewall rules to restrict access to these endpoints. Since the project is archived and no fixes are available, consider migrating to an alternative solution or disabling the service until a patch is released.

Hi! I’m here to help you understand CVE-2026-109967. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70