yt-dlp-web-ui: NULL pointer dereference in Service.Formats enables DoS
Summary
yt-dlp-web-ui through version 4.0.0 contains a NULL pointer dereference in the Service.Formats JSON-RPC method. A remote, unauthenticated attacker can crash the server with a single crafted request, for example with a url value like --version, which causes an unrecovered panic that terminates the process. The CVSS 4.0 base score is 8.7 and only availability is affected.
Affected
- yt-dlp-web-ui 0 through 4.0.0 (according to the CNA data)
- Earlier versions are also affected according to OSV
Fixed in
Unknown. The sources conflict: OSV lists a fixed commit (143cc28a97fb8e21c84c9436778fff480e2fa36b) but its release is unverified, and no vendor advisory was found.
Workaround
- Do not expose the service directly to untrusted networks.
- Enable RPC authentication (-auth with username and password) so that unauthenticated requests are rejected.
- Place the service behind a reverse proxy or VPN with access control.
Exploitation
- CISA SSVC: exploitation status is proof of concept, automatable: yes, technical impact: partial.
- No authentication is required and a single request is sufficient to crash the process.
Our recommendation
- Check whether yt-dlp-web-ui is running and whether it is reachable from untrusted networks.
- Restrict access to trusted networks and enable authentication until a fixed release is confirmed.
- Monitor the service for unexpected restarts or crashes.
- Update to a release confirmed by the vendor to contain the fix as soon as it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- yt-dlp-web-ui GitHub repository github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-109967 osv.dev
- NVD entry via Vulners vulners.com
- CVE aggregator entry (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:30.
Original description (NVD)
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
NVD references (5)
- https://github.com/marcopiovanello/yt-dlp-web-ui
- https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/formats/parser.go
- https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/rpc/service.go
- https://github.com/vazzzy071-crypto/security-advisories/blob/main/advisories/2026-10-marcopiovanello-yt-dlp-w…
- https://www.vulncheck.com/advisories/yt-dlp-web-ui-through-4.0.0-null-pointer-dereference-dos-via-service-for…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.