CVE-2026-33511 is a critical (CVSS 9.8) flaw in pyLoad, the Python download manager. A spoofed Host header defeats the localhost check on ClickNLoad endpoints. The record says versions from 0.4.20 up to 0.5.0b3.dev97 are affected, and the fix is 0.5.0b3.dev97.
What's affected
- Product: pyLoad (pip packages
pyloadandpyload-ng). - Affected per the record: from 0.4.20 to before 0.5.0b3.dev97. The advisory wording says up to and including 0.4.20, so verify your build against the advisory.
- Fixed: 0.5.0b3.dev97.
- Exposed feature: ClickNLoad endpoints that are meant to accept only local requests.
How to check if you're exposed
pip show pyload-ng
pip show pyload
Compare the version with 0.5.0b3.dev97. Also check whether the web or ClickNLoad port (the advisory example uses 9666) is reachable from outside the host.
Paste a lockfile or manifest into the free in-browser dependency scan to see whether pyLoad is in your tree. The Gold directory tracks this CVE, and reachability analysis helps you rank it against everything else you have open.
What to do now
- Upgrade pyload-ng to 0.5.0b3.dev97 or later.
- Until then, block outside access to the pyLoad web and ClickNLoad ports with a firewall. The advisory lists no workaround, so this is a precaution.
- Check the download queue and storage directory for entries you did not add.
- Do not expose pyLoad directly to the internet.
Why it matters
The local_check decorator allows a request when the client address is local or when the Host header looks local. The Host header is set by the client, so any remote caller can claim to be localhost. This is CWE-639, authorization bypass through a user controlled key. The advisory says this lets unauthenticated users add downloads, write files to the storage directory and run JavaScript.
The right fix is to trust only the connection's real remote address. This CVE is not in the CISA KEV catalog.
Quick check
Why does a Host header check fail here?
Because the client chooses the Host header. Only the network address of the connection is a trustworthy signal for a localhost only rule.
Sources
- https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw
- https://nvd.nist.gov/vuln/detail/CVE-2026-33511
Last reviewed: 19 October 2026.
