{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/yt-dlp-web-ui--4.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yt-dlp-web-ui:yt-dlp-web-ui:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-109967"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["yt-dlp-web-ui (\u003c= 4.0.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","web-application","cve-2026-109967"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe yt-dlp-web-ui application, up to and including version 4.0.0, is susceptible to a denial-of-service (DoS) vulnerability identified as CVE-2026-109967. The vulnerability exists within the Service.Formats JSON-RPC method. Remote, unauthenticated attackers can exploit this by submitting a crafted JSON-RPC request containing specific arguments, such as the \u0026quot;--version\u0026quot; flag. This input causes the underlying process to generate invalid JSON output from the yt-dlp utility, which leads to an unrecovered panic condition and subsequent termination of the server process. This vulnerability is significant for organizations relying on this software for media processing, as it allows trivial, unauthenticated service disruption.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows any unauthenticated remote attacker to terminate the yt-dlp-web-ui service. Frequent or automated exploitation of this flaw can result in a persistent denial-of-service condition, rendering the application unavailable for legitimate users and requiring manual intervention to restart the backend process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize upgrading to a version of yt-dlp-web-ui that addresses the NULL pointer dereference in the Service.Formats method. Implement network-level access controls to restrict access to the web UI and associated JSON-RPC endpoints to trusted IP addresses only. Monitor web server access logs for anomalous JSON-RPC requests containing flag-like arguments in the URL parameter.\u003c/p\u003e\n","date_modified":"2026-10-13T14:39:29Z","date_published":"2026-10-13T14:39:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-109967/","summary":"An unauthenticated remote attacker can crash the yt-dlp-web-ui application through version 4.0.0 by triggering a NULL pointer dereference via the Service.Formats JSON-RPC method.","title":"Denial of Service Vulnerability in yt-dlp-web-ui","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-109967/"}],"language":"en","title":"CraftedSignal Threat Feed - Yt-Dlp-Web-Ui (\u003c= 4.0.0)","version":"https://jsonfeed.org/version/1.1"}