CVE-2026-109967: yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
yt-dlp-web-ui versions through 4.0.0 are affected where an attacker can reach the Service.Formats JSON-RPC method over the network.
What does an attacker need to do to trigger the crash?
No authentication or user interaction is required. A remote attacker can send one Service.Formats request using a url value such as --version, which produces invalid yt-dlp JSON output and triggers an unrecovered panic.
What is the operational impact of successful exploitation?
The yt-dlp-web-ui server process terminates, causing a denial of service. The provided data does not indicate confidentiality or integrity impact.
How can I determine whether an instance is affected?
Confirm whether the deployment runs yt-dlp-web-ui 4.0.0 or an earlier version and exposes the Service.Formats JSON-RPC method to untrusted network clients. The vulnerable behavior is triggered when a url value such as --version leads to invalid yt-dlp JSON output and a process-terminating panic.