Unbounded Recursion Vulnerability in FastFeedParser by Kagisearch

CVE-2026-39376

What is CVE-2026-39376?

The FastFeedParser library, utilized for parsing RSS, Atom, and RDF feeds, is prone to an unbounded recursion vulnerability. In versions prior to 0.5.10, the parse() function can be exploited when it encounters a redirect URL that invokes HTML meta-refresh tags. This flaw allows an attacker to create an infinite loop of redirects, leading to excessive consumption of resources that can crash the Python process. Additional concerns arise as this vulnerability can be exploited alongside a Server-Side Request Forgery (SSRF) issue to target internal networks, potentially bypassing initial security checks.

References