Resource Exhaustion Vulnerability in Misskey Social Media Platform
CVE-2026-104817
8.7HIGH
What is CVE-2026-104817?
The Misskey social media platform is affected by a resource exhaustion vulnerability due to the fetch-rss API's lack of rate limiting and response-size restrictions. This vulnerability allows unauthenticated attackers to initiate unbounded outbound HTTP requests and trigger synchronous XML parsing. Consequently, this can lead to depletion of server resources, increased load on third-party servers, and the potential probing of accessible network services, especially with federation disabled. To mitigate this issue, users should upgrade to Misskey version 2026.7.0 or later, where it has been addressed.
Affected Version(s)
misskey >= 12.0.0, <= 13.14.2 <= 12.0.0, 13.14.2
misskey >= 2023.9.0-beta.1, < 2026.7.0 < 2023.9.0-beta.1, 2026.7.0