CVE-2026-104817 Details
Description
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
A denial-of-service vulnerability has been identified in Misskey, an open-source federated social media platform, affecting versions 12.112.1 prior to 2026.7.0. The issue arises in the fetch-rss API, which lacks rate limiting and response size restrictions, and performs synchronous XML parsing. This allows unauthenticated attackers to generate unbounded outbound HTTP requests and synchronous parsing, depleting server resources, amplifying requests to third-party servers, or probing network services, regardless of federation settings.
Users can upgrade to Misskey version 2026.7.0 or later, where this vulnerability has been fixed. Instructions for upgrading can be found in the Misskey repository's release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/misskey-dev/misskey/commit/a12ee2e5d72c40252e11a164b2231667c9697667 | [email protected] | Source CodeVendor |
| https://github.com/misskey-dev/misskey/releases/tag/2026.7.0 | [email protected] | Release NotesVendor |
| https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-405 | Asymmetric Resource Consumption (Amplification) | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Misskey | >= 12.112.1, < 2026.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | New CVE Received | [email protected] |
| Oct 13, 2026 | CVE Modified | CISA-ADP |