pyload-ng 0.5.0b3.dev101

Direct Vulnerabilities

Known vulnerabilities in the pyload-ng package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L Server-side Request Forgery (SSRF) pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the `is_global_address` function. An attacker can access internal network resources or sensitive endpoints by supplying specially crafted IPv6 addresses that are interpreted as globally routable, allowing bypass of network access controls. This is only exploitable if the host network supports 6to4 routing, has a NAT64 gateway, or resolves IPv6 transition forms to internal IPv4 endpoints. How to fix Server-side Request Forgery (SSRF)? A fix was pushed into the `master` branch but not yet published.	[0,)
H Allocation of Resources Without Limits or Throttling pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the accumulation of `Client` instances in the `clients` list within the event management process. An attacker can exhaust system memory and disrupt service availability by repeatedly sending requests with unique `uuid` values to the relevant API endpoint while authenticated. How to fix Allocation of Resources Without Limits or Throttling? A fix was pushed into the `master` branch but not yet published.	[0,)

Vulnerability

Vulnerable Version

Server-side Request Forgery (SSRF)

pyload-ng is a The free and open-source Download Manager written in pure Python

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the is_global_address function. An attacker can access internal network resources or sensitive endpoints by supplying specially crafted IPv6 addresses that are interpreted as globally routable, allowing bypass of network access controls. This is only exploitable if the host network supports 6to4 routing, has a NAT64 gateway, or resolves IPv6 transition forms to internal IPv4 endpoints.

How to fix Server-side Request Forgery (SSRF)?

A fix was pushed into the master branch but not yet published.

[0,)

Allocation of Resources Without Limits or Throttling

pyload-ng is a The free and open-source Download Manager written in pure Python

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the accumulation of Client instances in the clients list within the event management process. An attacker can exhaust system memory and disrupt service availability by repeatedly sending requests with unique uuid values to the relevant API endpoint while authenticated.

How to fix Allocation of Resources Without Limits or Throttling?

A fix was pushed into the master branch but not yet published.

[0,)

pyload-ng@0.5.0b3.dev101

The free and open-source Download Manager written in pure Python

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically