VYPR
← All advisories
High severityNVD Advisory· Published Oct 13, 2026

CVE-2026-104817

CVE-2026-104817

Description

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Misskey Dev/Misskeyreferences2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: 12.112.1 - 2026.7.0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.