CVE-2026-38361 describes multiple unauthenticated denial-of-service issues in fohrloop dash-uploader from version 0.1.0 up to 0.7.0a2. The vulnerabilities stem from the chunked-upload handler trusting unsanitized, attacker-controlled parameters such as flowTotalChunks and failing to enforce the documented max_file_size limit. Exploitation can lead to out-of-memory process crashes due to unbounded memory allocation, truncation of target files to zero bytes via a logic quirk, permanent disk exhaustion from never-cleaned temporary directories, and complete bypass of file size restrictions. These issues are categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-670 (Always-Incorrect Resource Release). No official patch or remediation level has been published as of the data provided.

The vulnerabilities allow remote, unauthenticated attackers to cause denial-of-service conditions by exhausting system memory, truncating files, and filling disk space permanently. This results in service disruption and potential data loss or corruption. There is no impact on confidentiality or integrity reported, but availability is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the dash-uploader service to trusted users or networks and monitor resource usage closely to detect potential exploitation attempts. Avoid exposing the vulnerable versions publicly.