Ashrafibrahim03

**Name of the Vulnerable Software and Affected Versions** File Browser versions prior to 2.63.6 **Description** Lack of maximum length validation for passwords allows an arbitrarily large string to be passed into the login API. When a large password is submitted, the `CheckPwd()` function in `users/password.go` attempts to hash the input, causing spikes in CPU and memory usage. This can lead to severe system lag, container crashes, and may cause the Docker daemon to return 500 status code errors even after the affected container is destroyed. The issue occurs when sending JSON in the request body to the `api/login` endpoint using the `password` variable. **Recommendations** Update to version 2.63.6.