Denial of Service Vulnerability in yt-dlp-web-ui

The yt-dlp-web-ui application, up to and including version 4.0.0, is susceptible to a denial-of-service (DoS) vulnerability identified as CVE-2026-109967. The vulnerability exists within the Service.Formats JSON-RPC method. Remote, unauthenticated attackers can exploit this by submitting a crafted JSON-RPC request containing specific arguments, such as the "--version" flag. This input causes the underlying process to generate invalid JSON output from the yt-dlp utility, which leads to an unrecovered panic condition and subsequent termination of the server process. This vulnerability is significant for organizations relying on this software for media processing, as it allows trivial, unauthenticated service disruption.

Impact

The vulnerability allows any unauthenticated remote attacker to terminate the yt-dlp-web-ui service. Frequent or automated exploitation of this flaw can result in a persistent denial-of-service condition, rendering the application unavailable for legitimate users and requiring manual intervention to restart the backend process.

Recommendation

Prioritize upgrading to a version of yt-dlp-web-ui that addresses the NULL pointer dereference in the Service.Formats method. Implement network-level access controls to restrict access to the web UI and associated JSON-RPC endpoints to trusted IP addresses only. Monitor web server access logs for anomalous JSON-RPC requests containing flag-like arguments in the URL parameter.