PT-2026-111817 · Git+1 · Misskey
CVE-2026-104817
·
Published
2026-10-13
·
Updated
2026-10-13
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:N/SA:L |
Name of the Vulnerable Software and Affected Versions
Misskey versions 12.112.1 through 2026.6.9
Description
The unauthenticated 'fetch-rss' API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. This allows an attacker to trigger unbounded outbound HTTP requests and synchronous parsing, which can exhaust instance resources, amplify requests toward third-party servers, or probe network-reachable services, even if federation is disabled.
Recommendations
Update to version 2026.7.0.
Exploit
Fix
SSRF
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Misskey