Executive brief
A vulnerability in the dash-uploader library, used for handling file uploads in Python Dash applications, allows remote attackers to crash the service or exhaust server resources. By sending specially crafted upload requests, an attacker can cause the server to run out of memory, fill up disk space, or delete existing files. This can lead to significant service outages and operational disruption for applications relying on this component.
Technical details
The chunked-upload handler in dash_uploader/httprequesthandler.py and dash_uploader/upload.py fails to sanitize attacker-controlled parameters such as flowTotalChunks. An attacker can trigger an out-of-memory (OOM) crash by providing an extremely large flowTotalChunks value, leading to unbounded memory allocation in the range() function. Additionally, setting flowTotalChunks to zero exploits a logic flaw where an empty list evaluation triggers file assembly, resulting in the truncation of target files. The component also fails to enforce max_file_size limits and neglects to clean up temporary directories, enabling permanent disk exhaustion. No patch is currently confirmed as the repository was archived in July 2025.
Affected products
- fohrloop dash-uploader 0.1.0 through 0.7.0a2
Timeline
- 2025-07-19: other: Repository archived by owner
- 2026-05-08: disclosed
- 2026-05-08: advisory