Audiobookshelf versions prior to 2.32.2 allow an administrator to upload an .audiobookshelf ZIP file that is decompressed entirely into memory with no size limits. A crafted backup containing a highly compressed details entry can inflate to hundreds of megabytes or more when decompressed, causing the server process to run out of memory and crash. This vulnerability is classified as a memory amplification denial‑of‑service flaw (CWE‑409).

The affected product is advplyr’s Audiobookshelf. All releases earlier than 2.32.2 are vulnerable, including 2.32.1 and earlier. The susceptibility exists on any deployment that exposes the POST /api/backups/upload endpoint to authenticated administrators.

The CVSS score of 4.9 indicates moderate severity. Because no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, exploitation is not widely reported, but the attack logic is straightforward: an authenticated administrator uploads a malicious ZIP. If the server’s environment allows unchecked memory allocation, a successful upload will exhaust RAM and terminate the process, causing a denial of service. The primary attack vector is an authenticated upload operation; no public network exposure is required beyond normal administrative access.