# CVE-2026-48987: pyLoad uncontrolled memory growth in EventManager

Source: https://junglewise.ai/threats/cve-2026-48987-pyload-uncontrolled-memory-growth-in-eventmanager  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-48987 · Severity: medium · CVSS 6.5 · Published 2026-09-15

pyLoad, a popular download manager, is vulnerable to a denial-of-service attack due to improper memory management. An authenticated user can send a large number of specific requests that cause the application to consume all available system memory. This can lead to the application crashing or the entire server becoming unstable and unresponsive, disrupting download operations and other hosted services.

Technologies: [pyload-ng (PyPI)](https://junglewise.ai/threats/technologies/pyload-ng). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-48987 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48987 being exploited in the wild.

**How severe is CVE-2026-48987?** Medium severity, with a CVSS score of 6.5, published 15 September 2026.

**Which products and versions are affected?** pyload-ng (PyPI) <= 0.5.0b3.dev100, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev100.

**Is there a fix for CVE-2026-48987?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48987 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48987?** Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability exists in the pyLoad EventManager module due to uncontrolled resource consumption (CWE-400). The `get_events` API endpoint creates a new `Client` instance for every unique `uuid` provided in a request and appends it to a global list. Although a `clean()` method exists to remove inactive clients, it is never invoked by the application core. An authenticated attacker can flood the `getEvents` endpoint with unique UUIDs, leading to memory exhaustion and an Out-of-Memory (OOM) kill. As of the advisory date, no patched version is specified, but mitigations include manually invoking `clean()` or implementing rate limiting.

## Affected products

- pyload pyload-ng <= 0.5.0b3.dev100

## Identifiers

- CVE-2026-48987
- GHSA-c2f9-4mc8-j656
- PYSEC-2026-2992

## Timeline

- 2026-07-08: disclosed: Advisory published to pyload/pyload repository
- 2026-07-09: advisory: GitHub Advisory GHSA-c2f9-4mc8-j656 published

## References

- [https://api.github.com/users/pevinkumar10](https://api.github.com/users/pevinkumar10)
- [https://github.com/pevinkumar10](https://github.com/pevinkumar10)
- [https://api.github.com/users/pevinkumar10/gists%7B/gist_id%7D](https://api.github.com/users/pevinkumar10/gists%7B/gist_id%7D)
- [https://api.github.com/users/pevinkumar10/repos](https://api.github.com/users/pevinkumar10/repos)
- [https://avatars.githubusercontent.com/u/191495526?v=4](https://avatars.githubusercontent.com/u/191495526?v=4)
- [https://api.github.com/users/pevinkumar10/events%7B/privacy%7D](https://api.github.com/users/pevinkumar10/events%7B/privacy%7D)

## Related threats

- [pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses)
- [pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service)
- [pyload-ng authentication bypass in getUserData/get_userdata](https://junglewise.ai/threats/pyload-ng-getuserdata-get-userdata-exposed-at-perms-any-allow-any-cd197c9d)
- [pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header](https://junglewise.ai/threats/pyload-rate-limit-bypass-and-audit-log-spoofing-via-trusted-client-0df0fd12)
- [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba)