Memory Exhaustion Vulnerability in pyLoad Download Manager by pyLoad Team
CVE-2026-48987

6.5MEDIUM

Key Information:

Vendor

Pyload

Status
Pyload
Vendor
CVE Published:
15 September 2026

What is CVE-2026-48987?

pyLoad, an open-source download manager, suffers from a memory exhaustion vulnerability due to improper handling of client objects within its EventManager. When unique UUIDs are authenticated via the getEvents API endpoint, these client objects accumulate without being cleaned up. This can lead to unbounded growth in process memory over time, which may eventually trigger out-of-memory conditions, causing serious performance issues, including denial of service. To mitigate this risk, users are advised to upgrade to version 0.5.0b3.dev101 or later, where the clean-up method is effectively invoked.

Affected Version(s)

pyload < 0.5.0b3.dev101

References

https://github.com/pyload/pyload/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/1b12dc7f348db8c14...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.