{"id":"CVE-2026-104817","title":"Misskey is an open source, federated social media platform","summary":"Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger …","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:N/SA:L","cwe":["CWE-405","CWE-770","CWE-918"],"vendor":"misskey-dev","product":"misskey","affected":["misskey >= 12.0.0, <= 13.14.2","misskey >= 2023.9.0-beta.1, < 2026.7.0"],"published":"2026-10-13","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:04:29.760","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104817","references":[{"url":"https://github.com/misskey-dev/misskey/commit/a12ee2e5d72c40252e11a164b2231667c9697667","label":"security-advisories@github.com"},{"url":"https://github.com/misskey-dev/misskey/releases/tag/2026.7.0","label":"security-advisories@github.com"},{"url":"https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"epss":0.0046,"epssPercentile":0.39649,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-13T19:03:52.462592Z"},"cvssSource":"cna","ingestedAt":"2026-10-13T19:43:28.909Z","slug":"CVE-2026-104817","body":"## Overview\n\nMisskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":221092,"id":"CVE-2026-104817","ts":1792027073017,"field":"cvss","old":null,"new":"8.7"},{"seq":221091,"id":"CVE-2026-104817","ts":1792027073017,"field":"severity","old":"none","new":"high"}]}