{"id":"CVE-2026-104817","title":"Misskey is an open source, federated social media platform","summary":"Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger …","severity":"none","cwe":["CWE-405","CWE-770","CWE-918"],"published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T19:17:55.697","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104817","references":[{"url":"https://github.com/misskey-dev/misskey/commit/a12ee2e5d72c40252e11a164b2231667c9697667","label":"security-advisories@github.com"},{"url":"https://github.com/misskey-dev/misskey/releases/tag/2026.7.0","label":"security-advisories@github.com"},{"url":"https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8","label":"security-advisories@github.com"}],"tags":["nvd"],"ingestedAt":"2026-10-13T19:43:28.909Z","slug":"CVE-2026-104817","body":"## Overview\n\nMisskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}