GHSA-vq8p-m3wm-gv5f pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

• PyPI pyload-ng: < 0.5.0b3.dev101 → fixed in 0.5.0b3.dev101

Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. VulnerableCode & Path: https://github.com/pyload/pyload/blob/8e447958b8a66c5899775e725a8b90bce6643004/src/pyload/webui/app/blueprints/api_blueprint.py#L73 Steps to Reproduce: 1. Log in to pyLoad (or use an API key, here i used api to communicate). 2. Prepare a large file (e.g., 10GB) . ```bash truncate -s 10G large_file.bin ``` 3. Send a multipart request to an API function that accepts a file, such as `check_online_status_container`: ```bash curl -X POST "http://localhost:8000/api/rpc" \ -H "X-API-Key: YOUR_API_KEY" \ -F "func=check_online_status_container" \ -F "container=@large_file.bin" ``` 4. Monitor the server's memory usage. The process will attempt to allocate memory for the entire file and last the process will be killed by the kernel. Impact • Denial of Service (DoS): The pyLoad process will be killed by the Operating System's Out-Of-Memory (OOM) killer, or the entire system may become unresponsive due to swap thrashing or memory exhaustion. • Service Instability: Any active downloads or tasks will be interrupted. Mitigations • Implement File Size Limits: Enforce a maximum size for uploaded files in the web server configuration (e.g., Nginx `client_max_body_size`).