CVE-2026-104817: Misskey: Lack of rate limiting and size restrictions in RSS fetching API
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Misskeyto a version that resolves this vulnerability.Fixed in 2026.7.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Misskey instances running versions from 12.112.1 up to, but not including, 2026.7.0 are affected. Federation does not need to be enabled for the issue to be exploitable.
What does an attacker need to exploit this issue?
The affected fetch-rss API is unauthenticated, so an attacker can invoke it without credentials. They can cause outbound HTTP requests and synchronous XML parsing through that API.
What are the practical impacts of exploitation?
An attacker can exhaust instance resources by triggering unbounded requests and parsing. They may also amplify requests to third-party servers or probe services reachable from the Misskey instance's network.
What should administrators do if they cannot patch immediately?
The provided information identifies version 2026.7.0 as the fix, but does not specify a workaround or mitigation for unpatched instances. Prioritize upgrading affected instances to 2026.7.0.