Description
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
Published: 2026-10-13
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A NULL pointer dereference occurs in the Service.Formats JSON‑RPC method when the client supplies a request that causes yt‑dlp to produce invalid JSON output. The resulting panic is unrecovered and terminates the server process, leading to a denial of service for users of the web UI. The flaw is classified as CWE‑476.

Affected Systems

The vulnerability affects the yt‑dlp‑web‑ui project, version 4.0.0 and earlier, developed by marcopiovanello. The affected component is the server’s Formats parser and RPC service layer.

Risk and Exploitability

With a CVSS score of 8.7 the vulnerability is deemed high severity, although an EPSS score is not available and the catalog entry is not listed in CISA’s KEV. Attackers can trigger the defect remotely and without authentication by sending a single JSON‑RPC request containing a specially crafted url field such as "--version" to the Service.Formats method. Because the server process terminates, any request to the service following the crash will fail until the process is restarted, allowing attackers to disrupt availability.

Generated by OpenCVE AI on October 13, 2026 at 18:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade yt‑dlp‑web‑ui to a version newer than 4.0.0, preferably the latest release that contains the fix.
  • Restrict access to the Service.Formats JSON‑RPC endpoint so that only trusted hosts or internal networks can reach it.
  • Modify or patch the server code to validate the url field in the Service.Formats method, rejecting empty or malformed values before invoking yt‑dlp.

Generated by OpenCVE AI on October 13, 2026 at 18:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Marcopiovanello
Marcopiovanello yt-dlp-web-ui
Vendors & Products Marcopiovanello
Marcopiovanello yt-dlp-web-ui

Tue, 13 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
Title yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Marcopiovanello Yt-dlp-web-ui
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T21:57:12.112Z

Reserved: 2026-10-13T11:26:13.465Z

Link: CVE-2026-109967

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-13T14:17:36.390

Modified: 2026-10-16T22:17:20.490

Link: CVE-2026-109967

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T20:45:18Z

Weaknesses