A denial-of-service vulnerability in the fohrloop dash-uploader package allows unauthenticated remote attackers to cause application crashes, memory exhaustion, and disk space depletion.

This is an improper input validation vulnerability within the chunked upload handler parameters, specifically affecting files such as dash_uploader/httprequesthandler.py and dash_uploader/upload.py, where remote, unauthenticated attackers can supply malicious values.

A successful exploit can result in severe application downtime and resource exhaustion, impacting service availability for legitimate users. With a CVSS score of 7.5, the high risk is driven by the fact that unauthenticated attackers can repeatedly crash the underlying service and fill available disk space without requiring any prior access.

Immediate Action: Review vendor and package repositories for security updates, and restrict access to upload endpoints if patches are not yet available.

Proactive Monitoring: Monitor server memory utilization, disk space usage, and error logs for abnormal allocation patterns related to upload requests.

Compensating Controls: Implement strict Web Application Firewall rules and rate limiting to inspect upload parameters and block oversized or malformed chunked requests.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub (https://github.com/a1ohadance/CVE-2026-38361) and a Nuclei detection template is available.

Security teams must treat this denial-of-service vulnerability with high urgency due to the ease of remote, unauthenticated exploitation. Apply available updates or apply compensating input validation rules immediately to protect service availability.