{"id":"CVE-2026-104817","summary":"Misskey: Lack of rate limiting and size restrictions in RSS fetching API","details":"Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.","aliases":["GHSA-4x7v-qx8f-g3p8"],"modified":"2026-10-15T02:47:18.591245820Z","published":"2026-10-13T18:39:30.169Z","database_specific":{"cwe_ids":["CWE-405","CWE-770","CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104817.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/misskey-dev/misskey/releases/tag/2026.7.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104817.json"},{"type":"ADVISORY","url":"https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104817"},{"type":"FIX","url":"https://github.com/misskey-dev/misskey/commit/a12ee2e5d72c40252e11a164b2231667c9697667"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/misskey-dev/misskey","events":[{"introduced":"781cebf19406c9db4c769f35a78c991326393b98"},{"introduced":"2939e8131d303f27ef24541fa8394369401be08b"},{"fixed":"a12ee2e5d72c40252e11a164b2231667c9697667"},{"fixed":"8ea4a0ecac058688f69706ab88de1fcd439e2621"}],"database_specific":{"extracted_events":[{"introduced":"12.0.0"},{"last_affected":"13.14.2"},{"introduced":"2023.9.0-beta.1"},{"fixed":"2026.7.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2026.7.0-beta.6","2026.7.0-beta.3","2026.7.0-beta.2","2026.7.0-beta.1","2026.7.0-beta.0","2026.7.0-alpha.5","2026.7.0-alpha.4","2026.7.0-alpha.3","2026.7.0-alpha.2","2026.7.0-alpha.1","2026.7.0-alpha.0","2026.6.1-alpha.1","2026.6.0-beta.1","2026.6.0-beta.0","2026.6.0-alpha.2","2026.6.0-alpha.1","2026.6.0-alpha.0","2026.5.4","2026.5.4-beta.0","2026.5.4-alpha.0","2026.5.3","2026.5.3-alpha.0","2026.5.2","2026.5.2-beta.1","2026.5.2-beta.0","2026.5.2-alpha.0","2026.5.1","2026.5.1-beta.0","2026.5.1-alpha.0","2026.5.0","2026.5.0-alpha.0","2026.4.0-beta.2","2026.4.0-beta.1","2026.4.0-beta.0","2026.4.0-alpha.6","2026.4.0-alpha.5","2026.4.0-alpha.4","2026.4.0-alpha.3","2026.4.0-alpha.2","2026.4.0-alpha.1","2026.4.0-alpha.0","2026.3.2","2026.3.2-beta.0","2026.3.2-alpha.2","2026.3.2-alpha.1","2026.3.2-alpha.0","2026.3.1","2026.3.1-alpha.0","2026.3.0","2026.3.0-alpha.0","2026.2.0-beta.0","2026.2.0-alpha.0","2026.1.0-beta.0","2026.1.0-alpha.4","2026.1.0-alpha.3","2026.1.0-alpha.2","2026.1.0-alpha.1","2026.1.0-alpha.0","2025.12.2","2025.12.2-beta.4","2025.12.2-beta.3","2025.12.2-beta.2","2025.12.2-alpha.0","2025.12.1","2025.12.1-alpha.1","2025.12.1-alpha.0","2025.12.0","2025.12.0-beta.0","2025.12.0-alpha.2","2025.12.0-alpha.1","2025.12.0-alpha.0","2025.11.2-alpha.4","2025.11.2-alpha.3","2025.11.2-alpha.2","2025.11.2-alpha.1","2025.11.2-alpha.0","2025.11.1","2025.11.1-beta.3","2025.11.1-beta.2","2025.11.1-beta.1","2025.11.1-beta.0","2025.11.1-alpha.2","2025.11.1-alpha.1","2025.11.1-alpha.0","2025.11.0","2025.11.0-rc.0","2025.11.0-beta.0","2025.11.0-alpha.4","2025.11.0-alpha.3","2025.11.0-alpha.2","2025.11.0-alpha.1","2025.11.0-alpha.0","2025.10.2","2025.10.2-beta.0","2025.10.2-alpha.0","2025.10.1","2025.10.1-beta.4","2025.10.1-beta.2","2025.10.1-beta.1","2025.10.1-beta.0","2025.10.1-alpha.6","2025.10.1-alpha.5","2025.10.1-alpha.4","2025.10.1-alpha.2","2025.10.1-alpha.1","2025.10.1-alpha.0","2025.10.0","2025.10.0-beta.2","2025.10.0-beta.1","2025.10.0-beta.0","2025.10.0-alpha.0","2025.9.1-alpha.2","2025.9.1-alpha.1","2025.9.1-alpha.0","2025.9.0","2025.9.0-rc.0","2025.9.0-beta.1","2025.9.0-beta.0","2025.9.0-alpha.2","2025.9.0-alpha.1","2025.9.0-alpha.0","2025.8.0","2025.8.0-rc.0","2025.8.0-beta.6","2025.8.0-beta.5","2025.8.0-beta.4","2025.8.0-beta.3","2025.8.0-beta.2","2025.8.0-beta.1","2025.8.0-beta.0","2025.8.0-alpha.13","2025.8.0-alpha.12","2025.8.0-alpha.11","2025.8.0-alpha.9","2025.8.0-alpha.8","2025.8.0-alpha.7","2025.8.0-alpha.6","2025.8.0-alpha.5","2025.8.0-alpha.4","2025.8.0-alpha.3","2025.8.0-alpha.2","2025.8.0-alpha.1","2025.8.0-alpha.0","2025.7.0","2025.7.0-rc.1","2025.7.0-rc.0","2025.7.0-beta.2","2025.7.0-beta.1","2025.7.0-alpha.0","2025.6.4-alpha.4","2025.6.4-alpha.3","2025.6.4-alpha.2","2025.6.4-alpha.1","2025.6.4-alpha.0","2025.6.3","2025.6.3-alpha.0","2025.6.2","2025.6.2-alpha.0","2025.6.1","2025.6.1-rc.0","2025.6.1-beta.2","2025.6.1-beta.1","2025.6.1-beta.0","2025.6.1-alpha.4","2025.6.1-alpha.2","2025.6.1-alpha.1","2025.6.1-alpha.0","2025.6.0","2025.6.0-beta.1","2025.6.0-beta.0","2025.6.0-alpha.0","2025.5.1","2025.5.1-beta.6","2025.5.1-beta.5","2025.5.1-beta.4","2025.5.1-beta.3","2025.5.1-beta.2","2025.5.1-beta.1","2025.5.1-alpha.5","2025.5.1-alpha.4","2025.5.1-alpha.3","2025.5.1-alpha.2","2025.5.1-alpha.1","2025.5.1-alpha.0","2025.5.0","2025.5.0-rc.0","2025.5.0-beta.0","2025.5.0-alpha.2","2025.5.0-alpha.1","2025.5.0-alpha.0","2025.4.1","2025.4.1-rc.0","2025.4.1-beta.9","2025.4.1-beta.8","2025.4.1-beta.7","2025.4.1-beta.6","2025.4.1-beta.2","2025.4.1-beta.0","2025.4.1-alpha.2","2025.4.1-alpha.1","2025.4.1-alpha.0","2025.4.0","2025.4.0-rc.5","2025.4.0-rc.4","2025.4.0-rc.0","2025.4.0-beta.1","2025.4.0-beta.0","2025.4.0-alpha.0","2025.3.2-beta.21","2025.3.2-beta.20","2025.3.2-beta.19","2025.3.2-beta.17","2025.3.2-beta.15","2025.3.2-beta.14","2025.3.2-beta.13","2025.3.2-beta.12","2025.3.2-beta.11","2025.3.2-beta.10","2025.3.2-beta.9","2025.3.2-beta.8","2025.3.2-beta.5","2025.3.2-beta.4","2025.3.2-beta.2","2025.3.2-beta.1","2025.3.2-beta.0","2025.3.2-alpha.11","2025.3.2-alpha.10","2025.3.2-alpha.8","2025.3.2-alpha.4","2025.3.2-alpha.3","2025.3.2-alpha.2","2025.3.2-alpha.1","2025.3.1","2025.3.1-beta.3","2025.3.1-beta.2","2025.3.1-beta.1","2025.3.1-beta.0","2025.3.1-alpha.0","2025.3.0","2025.3.0-beta.2","2025.3.0-beta.1","2025.3.0-beta.0","2025.3.0-alpha.0","2025.2.1","2025.2.1-beta.2","2025.2.1-beta.1","2025.2.1-beta.0","2025.2.1-alpha.0","2025.2.0","2025.2.0-beta.1","2025.2.0-beta.0","2025.2.0-alpha.0","2025.1.0","2025.1.0-beta.3","2025.1.0-beta.2","2025.1.0-beta.1","2025.1.0-beta.0","2025.1.0-alpha.0","2024.11.0","2024.11.0-beta.4","2024.11.0-alpha.3","2024.11.0-alpha.2","2024.11.0-alpha.1","2024.10.2-alpha.2","2024.10.2-alpha.1","2024.10.2-alpha.0","2024.10.1","2024.10.1-beta.6","2024.10.1-beta.5","2024.10.1-beta.4","2024.10.1-beta.3","2024.10.1-beta.2","2024.10.1-beta.1","2024.10.1-alpha.0","2024.10.0","2024.10.0-beta.6","2024.10.0-beta.5","2024.10.0-beta.4","2024.10.0-beta.3","2024.10.0-beta.2","2024.10.0-alpha.1","2024.10.0-alpha.0","2024.9.0","2024.9.0-beta.14","2024.9.0-alpha.13","2024.9.0-alpha.12","2024.9.0-alpha.11","2024.9.0-alpha.10","2024.9.0-alpha.9","2024.9.0-alpha.8","2024.9.0-alpha.7","2024.9.0-alpha.6","2024.9.0-alpha.5","2024.9.0-alpha.4","2024.9.0-alpha.3","2024.9.0-alpha.2","2024.9.0-alpha.1","2024.9.0-alpha.0","2024.8.0","2024.8.0-rc.5","2024.8.0-rc.4","2024.8.0-rc.3","2024.8.0-beta.2","2024.8.0-alpha.1","2024.8.0-alpha.0","2024.7.0","2024.7.0-rc.8","2024.7.0-rc.7","2024.7.0-rc.6","2024.7.0-rc.5","2024.7.0-rc.4","2024.7.0-beta.3","2024.7.0-beta.2","2024.7.0-beta.1","2024.7.0-beta.0","2024.2.0-beta.13","2024.2.0-beta.12","2024.2.0-beta.10","2024.2.0-beta.9","2024.2.0-beta.8","2024.2.0-beta.7","2024.2.0-beta.6","2024.2.0-beta.5","2024.2.0-beta.4","2024.2.0-beta.3","2024.2.0-beta.2","2024.2.0-beta.1","2023.12.0-beta.6","2023.12.0-beta.5","2023.12.0-beta.4","2023.12.0-beta.3","2023.12.0-beta.2","2023.12.0-beta.1","2023.11.1-beta.2","2023.11.1-beta.1","2023.11.0-beta.10","2023.11.0-beta.9","2023.11.0-beta.8","2023.11.0-beta.7","2023.11.0-beta.6","2023.11.0-beta.5","2023.11.0-beta.4","2023.11.0-beta.3","2023.11.0-beta.2","2023.11.0-beta.1","2023.10.2-beta.2","2023.10.2-beta.1","2023.10.0-beta.15","2023.10.0-beta.14","2023.10.0-beta.13","2023.10.0-beta.12","2023.10.0-beta.11","2023.10.0-beta.10","2023.10.0-beta.9","2023.10.0-beta.8","2023.10.0-beta.7","2023.10.0-beta.6","2023.10.0-beta.5","2023.10.0-beta.4","2023.10.0-beta.3","2023.10.0-beta.2","2023.10.0-beta.1","2023.9.0-rc.4","2023.9.0-rc.3","2023.9.0-rc.2","2023.9.0-rc.1","2023.9.0-beta.11","2023.9.0-beta.10","2023.9.0-beta.9","2023.9.0-beta.8","2023.9.0-beta.7","2023.9.0-beta.6","2023.9.0-beta.5","2023.9.0-beta.4","2023.9.0-beta.3","2023.9.0-beta.2","2023.9.0-beta.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104817.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:N/SA:L"}]}