CVE-2026-104817
Misskey is an open source, federated social media platform
- Risk score
- 65/100
- CVSS
- 8.7 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance reso…
- Affected
- See advisory
- Fix
- Upgrade the product to 2026.7.0 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.7 high
- Remotely exploitable without logging in
References
Original description
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
Last activity 13 Oct 2026. Patch Forecast updates every hour.