CVE-2026-48484

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.

• CWE-20
• CWE-400

• https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73
• https://github.com/pyload/pyload/commit/461cd66f30fa9e96453fb4d8c5c47467e452363c
• https://github.com/pyload/pyload/security/advisories/GHSA-vq8p-m3wm-gv5f
• https://github.com/pyload/pyload/security/advisories/GHSA-vq8p-m3wm-gv5f

Published

Oct 9, 2026

Last Modified

Oct 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4847A vulnerability was found in dameng100 muucmf 1.9.5.20260309…4.3
• CVE-2026-48479Use of uninitialized or invalid state in AMD Graphics Driver…6.9
• CVE-2026-4848A vulnerability was determined in dameng100 muucmf 1.9.5.202…4.3
• CVE-2026-48480The netty incubator codec.bhttp is a java language binary ht…6.6
• CVE-2026-48482GLPI is a free asset and IT management software package. Fro…9.4
• CVE-2026-48483TypeBot is a chatbot builder tool. Prior to version 3.17.0, …5.4
• CVE-2026-48485Quest Bot is an opensource Discord Bot. Prior to version 1.1…2.1
• CVE-2026-48486Signum Node is a HDD-mined cryptocurrency using an energy ef…7.5
• CVE-2026-48487Zeroconf is a pure Python implementation of multicast DNS se…5.3
• CVE-2026-48488phpMyFAQ is an open source FAQ web application. Prior to ver…2.7
• CVE-2026-48489Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-4849A vulnerability was identified in code-projects Simple Laund…6.1