pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header

Severity: medium · Published 2026-10-09

pyLoad is a download manager with a web-based user interface that uses an untrusted client-supplied HTTP header to determine client IP addresses for rate limiting and security logging. An attacker can bypass rate limits entirely by sending different header values with each request, and forge IP addresses in audit logs to evade IP-based blocking tools like fail2ban.

Technologies: pyLoad, pyload-ng (PyPI). Vendors: pyLoad, PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, published 9 October 2026.
Which products and versions are affected?
pyLoad 0.5.0b3 and pyload-develop-2 snapshot; pyload-ng (PyPI) = 0.5.0b3.dev101.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Use request.remote_addr (the real TCP peer address) for rate limiting and audit logging instead of trusting the X-Forwarded-For header, unless the application is deployed behind a trusted reverse proxy with explicit proxy-hop configuration enabled. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked over the network, in a web application.
Am I affected?
Check whether you run pyLoad or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use request.remote_addr (the real TCP peer address) for rate limiting and audit logging instead of trusting the X-Forwarded-For header, unless the application is deployed behind a trusted reverse proxy with explicit proxy-hop configuration enabled.

Technical details

The vulnerability stems from deriving the client IP from the client-controlled X-Forwarded-For HTTP header without proxy validation, then using this untrusted value as the key for rate-limit bucket tracking and as the source address in audit logs. The code takes the leftmost token from X-Forwarded-For, which is always attacker-supplied; the application server (Cheroot) terminates connections directly with no reverse proxy. An attacker can rotate the header value per request to create distinct rate-limit buckets (bypassing the 100/min limit on the API endpoint) and can inject arbitrary IPs into login/authentication failure logs to poison attribution.

Affected products

  • pyLoad pyLoad 0.5.0b3 and pyload-develop-2 snapshot

Timeline

  • 2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.