CVE-2026-48987

Name of the Vulnerable Software and Affected Versions pyload (affected versions not specified)

Description The EventManager module manages Client instances for event subscriptions. When the get events API is called with a unique uuid, a new Client instance is created and added to the clients list. Because the existing clean() method, designed to remove non-responding clients, is never invoked within the EventManager or the core application, memory consumption grows uncontrollably. This can lead to a Denial of Service (DoS) as the system exhausts available memory, potentially resulting in an Out-of-Memory (OOM) kill by the operating system. The issue is triggered via the getEvents API endpoint using the uuid parameter.

Recommendations Invoke the clean() method at the start of the get events function to remove inactive clients. Implement rate limiting on the getEvents API endpoint to prevent flooding with unique UUIDs.