CVE-2026-104817
HIGH
8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
405
Asymmetric Resource Consumption (Amplification)
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Amplification
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Applicable Platforms
Technologies:
Not Technology-Specific, Client Server
770
Allocation of Resources Without Limits or Throttling
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Applicable Platforms
All platforms may be affected
918
Server-Side Request Forgery (SSRF)
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Potential Impacts:
Read Application Data
Execute Unauthorized Code Or Commands
Bypass Protection Mechanism
Applicable Platforms
Technologies:
Web Based, AI/ML, Web Server
https://github.com/misskey-dev/misskey/commit/a12ee2e5d72c40252e11a164b2231667c…
https://github.com/misskey-dev/misskey/releases/tag/2026.7.0
https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8