CVE-2026-38361
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
Versions of fohrloop dash-uploader from 0.1.0 to 0.7.0a2 have multiple unauthenticated denial-of-service (DoS) issues. The chunked-upload handler does not validate attacker-controlled upload parameters, leading to various issues such as out-of-memory process crashes.
Risk Assessment
An attacker can exploit these vulnerabilities to cause system crashes, disk exhaustion, and bypass file size limits, potentially leading to significant disruptions in application functionality.
Recommendation
It is recommended to upgrade to the latest version of fohrloop dash-uploader to mitigate these vulnerabilities and implement additional validation mechanisms for upload parameters.
Other vulnerabilities in fohrloop dash-uploader
Original NVD description (English source)
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_uploader/upload.py) trusts unsanitized, attacker-controlled upload parameters (e.g. flowTotalChunks) and does not enforce the documented max_file_size limit, allowing a remote, unauthenticated attacker to cause an out-of-memory (OOM) process crash (unbounded range(1, flowTotalChunks + 1) allocation), truncation of the target file to zero bytes (flowTotalChunks=0, where the all([]) == True quirk runs the file-assembly branch on zero chunks), permanent disk exhaustion (never-cleaned-up temporary directories per flowIdentifier), and a complete bypass of the documented max_file_size limit.