CVE-2026-103937: Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Misskeyto a version that resolves this vulnerability.Fixed in 2026.7.0
Event History
Frequently Asked Questions
Which deployments are affected?
Misskey deployments running versions from 13.0.0 until 2025.4.1, or from 2025.5.0 until 2026.7.0, are affected. Federation does not need to be enabled for exploitation.
What does an attacker need to do to trigger the denial of service?
An attacker can repeatedly upload files, causing cleanup processing not to execute. This can exhaust available storage or file descriptors and make the service unavailable.
How can administrators determine whether they are at risk?
Administrators should check the deployed Misskey version and whether the instance permits file uploads. Affected version ranges are 13.0.0 through 2025.4.1 and 2025.5.0 through versions before 2026.7.0.
What is the available remediation?
Upgrade Misskey to version 2026.7.0, which fixes the cleanup-processing issue.