Enrich GHSA-xp7f-v245-w3w8 (CVE-2026-38361, dash-uploader DoS suite)

[a1ohadance]

Enriches GHSA-xp7f-v245-w3w8 (CVE-2026-38361) with the metadata that's currently missing, blocking Dependabot from firing for users of dash-uploader.

Changes

• affected: was empty []. Now lists PyPI/dash-uploader with all 16 published releases (0.1.0 through 0.7.0a2) and an ECOSYSTEM range with last_affected: 0.7.0a2. The package was archived 2025-07-19; no patched version exists.
• summary: added (was missing).
• details: replaced the auto-imported description with full Impact / Affected versions / Mitigation / References sections, breaking out the three DoS primitives in the same library:
  • OOM (CWE-400): unbounded range(1, flowTotalChunks + 1) list comprehension on user input → ~2.9 GB allocation per request.
  • TRUNCATE (CWE-670): flowTotalChunks=0 triggers the all([]) == True quirk so the assembly branch runs on zero chunks, os.unlinking the target file and replacing it with an empty file. Composes with GHSA-3rf6-x59v-5jfv path traversal in upload_id for arbitrary-file truncate.
  • EXHAUST (CWE-400): unique flowIdentifier per request creates never-cleaned-up temp directories. Sustained disk fill.
• credits: added (was missing) — Muhammad Fitri bin Mohd Sultan as FINDER.
• references: added cross-link to companion advisory GHSA-3rf6-x59v-5jfv (CVE-2026-38360, the path-traversal-to-RCE companion advisory). Tagged the upstream package URL with PACKAGE and the public PoC with EVIDENCE.

Verification

• JSON validates against https://raw.githubusercontent.com/ossf/osv-schema/main/validation/schema.json (OSV schema 1.4.0).
• All 16 versions cross-checked against https://pypi.org/pypi/dash-uploader/json.
• Companion advisory enrichment for GHSA-3rf6-x59v-5jfv submitted as separate PR per the contribution guide's "one advisory per PR" rule.

Why this matters

The advisory is currently "affected": [], which means Dependabot does not fire for any user with dash-uploader in their requirements.txt / pyproject.toml. The whole defensive value of GHSA — automatic alerts to dependents of an abandoned package — is gated on populating that field. This PR populates it.

Disclosure context

• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-38361
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-38361
• Public PoC: https://github.com/a1ohadance/CVE-2026-38361
• Upstream issue (archived repo): dash-uploader is archived fohrloop/dash-uploader#153