Unbounded Recursion Vulnerability in FastFeedParser by Kagisearch
CVE-2026-39376
Key Information:
- Vendor
Kagisearch
- Status
- Vendor
- CVE Published:
- 7 April 2026
Badges
What is CVE-2026-39376?
The FastFeedParser library, utilized for parsing RSS, Atom, and RDF feeds, is prone to an unbounded recursion vulnerability. In versions prior to 0.5.10, the parse() function can be exploited when it encounters a redirect URL that invokes HTML meta-refresh tags. This flaw allows an attacker to create an infinite loop of redirects, leading to excessive consumption of resources that can crash the Python process. Additional concerns arise as this vulnerability can be exploited alongside a Server-Side Request Forgery (SSRF) issue to target internal networks, potentially bypassing initial security checks.
Affected Version(s)
fastfeedparser < 0.5.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.