MEDIUM5.5

PYSEC-2026-39

Details

Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the URL field. Attackers can paste a buffer of 5000 characters into the 'From URL' field during torrent addition to trigger an application crash.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/deluge

Introduced in: 0

No fixed version published yet for deluge (pip). Pin to a known-safe version or switch to an alternative.

References

http://download.deluge-torrent.org/windows/deluge-1.3.15-win32-py2.7.exe[WEB]
https://dev.deluge-torrent.org/[WEB]
https://www.vulncheck.com/advisories/deluge-denial-of-service-via-url-field[ADVISORY]
https://www.exploit-db.com/exploits/46883[EVIDENCE]