GCVE - cpe:2.3:a:fohrloop:dash-uploader:0.7.0:alpha2:*:*:*:python:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:fohrloop:dash-uploader:0.7.0:alpha2:*:*:*:python:*:*

part: a version: 0.7.0 update: alpha2

Notes

Imported from purl2cpe mapping

PURL	Source	Last updated
`pkg:github/fohrloop/dash-uploader`	purl2cpe	2026-07-28 16:40:51.738926
`pkg:pypi/dash-uploader`	purl2cpe	2026-07-28 16:40:51.738927

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-38361`	vulnerable	2026-06-08 08:01:16.054129	Details available Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_uploader/upload.py) trusts unsanitized, attacker-controlled upload parameters (e.g. flowTotalChunks) and does not enforce the documented max_file_size limit, allowing a remote, unauthenticated attacker to cause an out-of-memory (OOM) process crash (unbounded range(1, flowTotalChunks + 1) allocation), truncation of the target file to zero bytes (flowTotalChunks=0, where the all([]) == True quirk runs the file-assembly branch on zero chunks), permanent disk exhaustion (never-cleaned-up temporary directories per flowIdentifier), and a complete bypass of the documented max_file_size limit. Published: 2026-05-08T00:00:00.000Z Updated: 2026-06-10T15:28:24.174Z Open on db.gcve.eu Reference links https://github.com/fohrloop/dash-uploader https://pypi.org/project/dash-uploader/ https://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py https://github.com/fohrloop/dash-uploader/issues/153 https://pypistats.org/packages/dash-uploader	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.