The vulnerability in pyLoad's EventManager module arises because each unique UUID from the get_events API causes a new Client instance to be appended to an internal clients list without ever removing inactive clients. Although a clean() method exists to remove non-responding clients, it is never called in the codebase. This results in uncontrolled memory growth as the clients list expands indefinitely with each unique UUID request. Attackers can exploit this by sending a large number of requests with unique UUIDs, causing the pyLoad process to consume all available memory, leading to denial of service. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), CWE-401 (Improper Release of Memory), and CWE-770 (Allocation of Resources Without Limits or Throttling). No official patch or fix is currently documented. Recommended mitigations are to call the clean() method to purge inactive clients before processing new requests and to implement rate limiting on the getEvents API endpoint to prevent flooding.

The vulnerability causes the pyLoad process to consume increasing amounts of memory without release, eventually exhausting system memory. This leads to denial of service conditions, including potential out-of-memory kills by the operating system or broader system instability affecting other services on the host. There is no direct impact on confidentiality or integrity reported.

No official patch or fix is currently available. It is recommended to modify the pyLoad EventManager code to invoke the clean() method at the start of the get_events API handler to remove inactive Client instances and prevent unbounded memory growth. Additionally, implementing rate limiting on the getEvents API endpoint can help prevent abuse by limiting the number of unique UUID requests from a single client. Monitor for updates from the vendor or project repository for any official fixes.