CVE-2026-48987
Received Received - Intake

Memory Exhaustion in pyLoad via Unbounded Client Objects

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client object to the clients list for each unique uuid submitted to the authenticated getEvents API endpoint, but get_events does not invoke the available clean method to remove inactive clients. An authenticated user can repeatedly submit unique UUID values, causing retained client objects and process memory to grow without bound even after requests stop. The resulting memory exhaustion can trigger an operating-system out-of-memory termination of pyLoad or host-wide instability and denial of service. This issue is fixed in version 0.5.0b3.dev101.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-48987
EUVD
EUVD-2026-78594

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pyload pyload to 0.5.0b3.dev101 (exc)
pyload pyload-ng to 0.5.0b3.dev101 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory exhaustion vulnerability in pyLoad versions prior to 0.5.0b3.dev101. The EventManager appends Client objects to a list for each unique UUID submitted to the authenticated getEvents API endpoint without removing inactive clients. This causes unbounded memory growth leading to potential system instability or denial of service.

Detection Guidance

Monitor pyLoad process memory usage and check for excessive client objects in EventManager. Look for repeated unique UUID submissions to the getEvents API endpoint. Use system monitoring tools like top, htop, or ps to observe memory consumption trends.

Impact Analysis

An authenticated attacker could repeatedly submit unique UUIDs to the getEvents endpoint, causing pyLoad to consume all available memory. This may trigger an operating system out-of-memory termination of pyLoad or cause broader system instability and denial of service.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service conditions. Memory exhaustion may disrupt pyLoad's availability, potentially affecting systems handling sensitive data. GDPR requires ensuring availability of processing systems, while HIPAA mandates reliable access to protected health information systems. Uncontrolled resource consumption could violate these availability requirements.

Mitigation Strategies

Upgrade pyLoad to version 0.5.0b3.dev101 or later. Implement rate limiting on the getEvents API endpoint. Add monitoring for memory usage and client list size. Restart pyLoad service after upgrade to clear existing memory leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48987. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart