CVE-2026-48987: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event

Executive brief

pyLoad, a popular download manager, is vulnerable to a denial-of-service attack due to improper memory management. An authenticated user can send a large number of specific requests that cause the application to consume all available system memory. This can lead to the application crashing or the entire server becoming unstable and unresponsive, disrupting download operations and other hosted services.

Technical details

A resource exhaustion vulnerability exists in the pyLoad EventManager module due to uncontrolled resource consumption (CWE-400). The `get_events` API endpoint creates a new `Client` instance for every unique `uuid` provided in a request and appends it to a global list. Although a `clean()` method exists to remove inactive clients, it is never invoked by the application core. An authenticated attacker can flood the `getEvents` endpoint with unique UUIDs, leading to memory exhaustion and an Out-of-Memory (OOM) kill. As of the advisory date, no patched version is specified, but mitigations include manually invoking `clean()` or implementing rate limiting.

Affected products

• pyload pyload-ng <= 0.5.0b3.dev100

Timeline

• 2026-07-08: disclosed: Advisory published to pyload/pyload repository
• 2026-07-09: advisory: GitHub Advisory GHSA-c2f9-4mc8-j656 published

References

• https://api.github.com/users/pevinkumar10
• https://github.com/pevinkumar10
• https://api.github.com/users/pevinkumar10/gists%7B/gist_id%7D
• https://api.github.com/users/pevinkumar10/repos
• https://avatars.githubusercontent.com/u/191495526?v=4
• https://api.github.com/users/pevinkumar10/events%7B/privacy%7D