Security readout for executives and security teams
Plain-English summary
CVE-2026-38361 affects fohrloop dash-uploader versions 0.1.0 through 0.7.0a2. An unauthenticated remote user can abuse file-upload parameters to crash the application process, consume disk space, or corrupt an upload target. The main business risk is outage for Dash applications that expose this uploader to untrusted users.
Executive priority
Treat as a high-priority availability risk for any externally reachable Dash application using dash-uploader. Prioritize inventory and exposure reduction now, then follow vendor or advisory updates for remediation. It is less urgent for internal-only or unused deployments, but still warrants validation.
Technical view
The chunked-upload handler trusts attacker-controlled parameters such as flowTotalChunks and does not enforce the documented max_file_size limit. Reported impacts include out-of-memory crash through unbounded allocation, zero-byte file truncation when zero chunks are accepted, persistent temporary-directory disk exhaustion, and max_file_size bypass. CVSS is 7.5, network exploitable, low complexity, no privileges or user interaction.
Likely exposure
Exposure is likely limited to Python Dash applications using fohrloop dash-uploader 0.1.0 through 0.7.0a2, especially where upload endpoints are internet-facing or reachable by unauthenticated users. The source bundle does not identify downstream products or CPEs.
Exploitation context
The CVE describes unauthenticated network denial of service. KEV is false, and the provided sources do not establish active exploitation in the wild. A public GitHub repository is listed for the CVE, so defenders should assume details may be discoverable without treating that as confirmed exploitation.
Researcher notes
Evidence is strongest for application-layer denial of service and file-handling integrity side effects in dash-uploader. The affected range is stated as 0.1.0 through 0.7.0a2. No official patch details are present in the supplied bundle. Avoid assuming broader product impact without confirming dependency use.
Mitigation direction
- Inventory applications using dash-uploader and identify exposed upload endpoints.
- Check upstream project, PyPI, and GitHub advisory pages for fixed versions or maintainer guidance.
- Restrict unauthenticated access to upload functionality where business requirements allow.
- Add operational controls for request size, upload rate, and disk usage at surrounding layers.
- Monitor application memory, temporary upload directories, and unexpected zero-byte upload outputs.
Validation and detection
- Confirm installed dash-uploader version in each Python environment.
- Review whether affected upload routes are reachable without authentication.
- Check configuration and surrounding controls for upload size and rate enforcement.
- Inspect temporary upload storage for unbounded growth or stale per-upload directories.
- Review logs and service metrics for upload-triggered crashes or disk pressure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-670: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-38361 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/fohrloop/dash-uploaderCVE reference, mitre
- https://pypi.org/project/dash-uploader/CVE reference, mitre
- https://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.pyCVE reference, mitre
- https://github.com/fohrloop/dash-uploader/issues/153CVE reference, mitre
- https://pypistats.org/packages/dash-uploaderCVE reference, mitre
- https://libraries.io/pypi/dash-uploaderCVE reference, mitre
- https://pepy.tech/project/dash-uploaderCVE reference, mitre
- https://docs.python.org/3/library/functions.html#allCVE reference, mitre
- https://github.com/a1ohadance/CVE-2026-38361CVE reference, mitre
- https://github.com/github/advisory-database/pull/7636CVE reference, mitre
- https://github.com/advisories/GHSA-xp7f-v245-w3w8CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Always-Incorrect Control Flow Implementation
Always-Incorrect Control Flow Implementation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.