PT-2026-26952 · Deluge · Deluge

Victor Mondragón · Published 2026-03-22 · Updated 2026-03-22 · CVE-2019-25586

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Deluge version 1.3.15

Description A denial of service issue exists in Deluge that allows local attackers to crash the application. This occurs when an excessively long string is provided in the URL field. Specifically, attackers can paste a 5000-character buffer into the 'From URL' field during torrent addition, leading to an application crash.

Recommendations Update to a newer version of Deluge that addresses this issue. As a temporary workaround, limit the length of the input allowed in the 'From URL' field.

Exploit

Fix

Weakness Enumeration

CWE-466

Related Identifiers

CVE-2019-25586

PYSEC-2026-39

Affected Products

Deluge

References · 11

• 🔥 https://exploit-db.com/exploits/46883 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-25586 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-25586 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-25586 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-25586 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-39 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-25586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25586 · Security Note
• https://dev.deluge-torrent.org · Note
• http://download.deluge-torrent.org/windows/deluge-1.3.15-win32-py2.7.exe · Note
• https://vulncheck.com/advisories/deluge-denial-of-service-via-url-field · Note