id: PYSEC-2026-38
published: "2026-03-22T01:16:56.497Z"
modified: "2026-03-24T14:42:41.500Z"
aliases:
- CVE-2019-25585
details: Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Webseeds field. Attackers can paste a buffer of 5000 bytes into the Webseeds field during torrent creation to trigger an application crash.
affected:
- package:
    name: deluge
    ecosystem: PyPI
    purl: pkg:pypi/deluge
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 1.3.15
  ecosystem_specific: {}
references:
- type: WEB
  url: http://download.deluge-torrent.org/windows/deluge-1.3.15-win32-py2.7.exe
- type: WEB
  url: https://dev.deluge-torrent.org/
- type: ADVISORY
  url: https://www.vulncheck.com/advisories/deluge-denial-of-service-via-webseeds-field
- type: EVIDENCE
  url: https://www.exploit-db.com/exploits/46884
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H