Denial of Service Vulnerability in Misskey Open Source Social Media Platform
CVE-2026-103937
8.7HIGH
What is CVE-2026-103937?
Misskey, an open-source federated social media platform, has reported a significant vulnerability in versions 13.0.0 through 2025.4.1 and 2025.5.0 through 2026.7.0, wherein file upload cleanup processes might not execute correctly. This oversight can lead to resource exhaustion, causing denial of service irrespective of whether the federation feature is activated. Users should upgrade to version 2026.7.0 to address this issue and ensure stable platform functionality.
Affected Version(s)
misskey >= 12.0.0, <= 13.14.2 <= 12.0.0, 13.14.2
misskey >= 2023.9.0-beta.1, < 2025.4.1 < 2023.9.0-beta.1, 2025.4.1
misskey >= 2025.5.0, < 2026.7.0 < 2025.5.0, 2026.7.0