CVE-2026-104817 | BDVDB-2026-388332 Detail

Description#

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-13Record published in the CVE List.