{"schema":"threatline.record/2","record":{"id":"CVE-2026-104817","aliases":["GHSA-4x7v-qx8f-g3p8"],"summary":"Misskey: Lack of rate limiting and size restrictions in RSS fetching API","details":"Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.","categories":["Unclassified"],"product":"misskey","vendor":"misskey-dev","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104817","source_modified_at":"2026-10-13T19:04:03.012Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"misskey","vendor":"misskey-dev","versions":[{"status":"affected","version":">= 12.0.0, <= 13.14.2"},{"status":"affected","version":">= 2023.9.0-beta.1, < 2026.7.0"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8","source_modified_at":"2026-10-03T05:42:46Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"n/a","name":"Misskey"},"range":">= 12.112.1"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8","source_modified_at":"2026-10-03T05:42:46Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"n/a","name":"Misskey"},"version":"2026.7.0"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0046,"percentile":0.38867,"score_date":"2026-10-23"},"published_at":"2026-10-13T18:39:30.169Z","modified_at":"2026-10-13T19:04:03.012Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-104817","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-13T19:04:03.012Z"},{"source":"GitHub Advisory Database","url":"https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8","fetched_at":"2026-10-23T22:01:05.715934Z","source_modified_at":"2026-10-03T05:42:46Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104817","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/misskey-dev/misskey/commit/a12ee2e5d72c40252e11a164b2231667c9697667","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/misskey-dev/misskey/releases/tag/2026.7.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-13T19:03:52.462592Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-13T19:04:03.012Z","content_hash":"b80470dec0a03e01f95abc0e0cee3032a2a15485570f12bf198569792bd37671"}}