Deluge 1.3.15 contains a denial of service vulnerability that can be triggered by entering an excessively long string into the "From URL" field when adding a torrent. When a local user supplies a buffer of 5000 characters, the application crashes, rendering the client unusable. The weakness is a buffer overflow involving improper string handling (CWE‑466). The impact is limited to availability of the application for the affected account but can be disruptive in environments where Deluge is used for automated torrent handling.

The vulnerability affects the Deluge torrent client, specifically version 1.3.15. No other versions or products are listed as affected.

The CVSS score of 6.9 indicates a medium severity risk. EPSS data is unavailable, but the vulnerability is local and requires an attacker to have access to the Deluge client or to a user on the same machine. The vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit the flaw by simply opening the client and entering a long URL into the interface, causing a crash without additional privileges.