CVE-2026-38361
HighPublic exploitMultiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2.
Published May 8, 2026 · Updated Jun 10, 2026 · Also known as PYSEC-2026-37
Key Facts
Patch immediately- CVE-2026-38361 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Dash-Uploader (Fohrloop).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 2.8% probability of exploitation in the next 30 days.
- Fixed versions are available, including Dash-Uploader 0.7.0a1, Dash-Uploader 0.6.1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
2.8%
Higher than 86.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-38361 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_uploader/upload.py) trusts unsanitized, attacker-controlled upload parameters (e.g. flowTotalChunks) and does not enforce the documented max_file_size limit, allowing a remote, unauthenticated attacker to cause an out-of-memory (OOM) process crash (unbounded range(1, flowTotalChunks + 1) allocation), truncation of the target file to zero bytes (flowTotalChunks=0, where the all([]) == True quirk runs the file-assembly branch on zero chunks), permanent disk exhaustion (never-cleaned-up temporary directories per flowIdentifier), and a complete bypass of the documented max_file_size limit.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Dash-UploaderFohrloop | 0.7.0-alpha1, 0.7.0-alpha2, >= 0.1.0 | 0.6.1 |
Patched Releases
Dash-Uploader
0.7.0a1, 0.6.1
Timeline
Publicly disclosed
May 8, 2026
Last updated
Jun 10, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
- CWE-670 Always-Incorrect Control Flow Implementation
References
- advisoryhttps://github.com/fohrloop/dash-uploader/issues/153
- exploithttps://github.com/a1ohadance/CVE-2026-38361
- articlehttps://docs.python.org/3/library/functions.html#all
- articlehttps://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py
- articlehttps://libraries.io/pypi/dash-uploader
FAQ
Common Questions.
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2.
Affected: Dash-Uploader (Fohrloop) versions 0.7.0-alpha1, 0.7.0-alpha2, >= 0.1.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Dash-Uploader 0.7.0a1, Dash-Uploader 0.6.1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-38361 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo