High
Misskey: Lack of rate limiting and size restrictions in RSS fetching API
Type: advisorySources: OSV
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-104817
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 17:31 UTC · Revision 1
Source evidence
Misskey: Lack of rate limiting and size restrictions in RSS fetching API
core-osv · Original sourcePublished 13 Oct 2026, 18:39 UTC
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
osv:CVE-2026-104817
Complete source record
{
"id": "bff4ce4045181667bc098b89e579b63e0e7e73ac34e377cfac8e1f841c8bd256",
"url": "https://osv.dev/vulnerability/CVE-2026-104817",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Misskey: Lack of rate limiting and size restrictions in RSS fetching API",
"summary": "Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.",
"evidence": "osv:CVE-2026-104817",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-104817",
"aliases": [
"CVE-2026-104817",
"GHSA-4x7v-qx8f-g3p8"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:N/SA:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/misskey-dev/misskey",
"type": "GIT",
"events": [
{
"introduced": "781cebf19406c9db4c769f35a78c991326393b98"
},
{
"last_affected": "a8d45d4b0d24e0c422d4e6d8feab57035239db56"
},
{
"introduced": "2939e8131d303f27ef24541fa8394369401be08b"
},
{
"fixed": "8ea4a0ecac058688f69706ab88de1fcd439e2621"
},
{
"fixed": "a12ee2e5d72c40252e11a164b2231667c9697667"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "12.0.0"
},
{
"last_affected": "13.14.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2023.9.0-beta.1"
},
{
"fixed": "2026.7.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "a12ee2e5d72c40252e11a164b2231667c9697667"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "8ea4a0ecac058688f69706ab88de1fcd439e2621"
}
],
"source": "REFERENCES_TAG",
"original_tag": "2026.7.0"
}
]
}
}
],
"versions": [
"2026.7.0-beta.6",
"2026.7.0-beta.3",
"2026.7.0-beta.2",
"2026.7.0-beta.1",
"2026.7.0-beta.0",
"2026.7.0-alpha.5",
"2026.7.0-alpha.4",
"2026.7.0-alpha.3",
"2026.7.0-alpha.2",
"2026.7.0-alpha.1",
"2026.7.0-alpha.0",
"2026.6.1-alpha.1",
"2026.6.0-beta.1",
"2026.6.0-beta.0",
"2026.6.0-alpha.2",
"2026.6.0-alpha.1",
"2026.6.0-alpha.0",
"2026.5.4",
"2026.5.4-beta.0",
"2026.5.4-alpha.0",
"2026.5.3",
"2026.5.3-alpha.0",
"2026.5.2",
"2026.5.2-beta.1",
"2026.5.2-beta.0",
"2026.5.2-alpha.0",
"2026.5.1",
"2026.5.1-beta.0",
"2026.5.1-alpha.0",
"2026.5.0",
"2026.5.0-alpha.0",
"2026.4.0-beta.2",
"2026.4.0-beta.1",
"2026.4.0-beta.0",
"2026.4.0-alpha.6",
"2026.4.0-alpha.5",
"2026.4.0-alpha.4",
"2026.4.0-alpha.3",
"2026.4.0-alpha.2",
"2026.4.0-alpha.1",
"2026.4.0-alpha.0",
"2026.3.2",
"2026.3.2-beta.0",
"2026.3.2-alpha.2",
"2026.3.2-alpha.1",
"2026.3.2-alpha.0",
"2026.3.1",
"2026.3.1-alpha.0",
"2026.3.0",
"2026.3.0-alpha.0",
"2026.2.0-beta.0",
"2026.2.0-alpha.0",
"2026.1.0-beta.0",
"2026.1.0-alpha.4",
"2026.1.0-alpha.3",
"2026.1.0-alpha.2",
"2026.1.0-alpha.1",
"2026.1.0-alpha.0",
"2025.12.2",
"2025.12.2-beta.4",
"2025.12.2-beta.3",
"2025.12.2-beta.2",
"2025.12.2-alpha.0",
"2025.12.1",
"2025.12.1-alpha.1",
"2025.12.1-alpha.0",
"2025.12.0",
"2025.12.0-beta.0",
"2025.12.0-alpha.2",
"2025.12.0-alpha.1",
"2025.12.0-alpha.0",
"2025.11.2-alpha.4",
"2025.11.2-alpha.3",
"2025.11.2-alpha.2",
"2025.11.2-alpha.1",
"2025.11.2-alpha.0",
"2025.11.1",
"2025.11.1-beta.3",
"2025.11.1-beta.2",
"2025.11.1-beta.1",
"2025.11.1-beta.0",
"2025.11.1-alpha.2",
"2025.11.1-alpha.1",
"2025.11.1-alpha.0",
"2025.11.0",
"2025.11.0-rc.0",
"2025.11.0-beta.0",
"2025.11.0-alpha.4",
"2025.11.0-alpha.3",
"2025.11.0-alpha.2",
"2025.11.0-alpha.1",
"2025.11.0-alpha.0",
"2025.10.2",
"2025.10.2-beta.0",
"2025.10.2-alpha.0",
"2025.10.1",
"2025.10.1-beta.4",
"2025.10.1-beta.2",
"2025.10.1-beta.1",
"2025.10.1-beta.0",
"2025.10.1-alpha.6",
"2025.10.1-alpha.5",
"2025.10.1-alpha.4",
"2025.10.1-alpha.2",
"2025.10.1-alpha.1",
"2025.10.1-alpha.0",
"2025.10.0",
"2025.10.0-beta.2",
"2025.10.0-beta.1",
"2025.10.0-beta.0",
"2025.10.0-alpha.0",
"2025.9.1-alpha.2",
"2025.9.1-alpha.1",
"2025.9.1-alpha.0",
"2025.9.0",
"2025.9.0-rc.0",
"2025.9.0-beta.1",
"2025.9.0-beta.0",
"2025.9.0-alpha.2",
"2025.9.0-alpha.1",
"2025.9.0-alpha.0",
"2025.8.0",
"2025.8.0-rc.0",
"2025.8.0-beta.6",
"2025.8.0-beta.5",
"2025.8.0-beta.4",
"2025.8.0-beta.3",
"2025.8.0-beta.2",
"2025.8.0-beta.1",
"2025.8.0-beta.0",
"2025.8.0-alpha.13",
"2025.8.0-alpha.12",
"2025.8.0-alpha.11",
"2025.8.0-alpha.9",
"2025.8.0-alpha.8",
"2025.8.0-alpha.7",
"2025.8.0-alpha.6",
"2025.8.0-alpha.5",
"2025.8.0-alpha.4",
"2025.8.0-alpha.3",
"2025.8.0-alpha.2",
"2025.8.0-alpha.1",
"2025.8.0-alpha.0",
"2025.7.0",
"2025.7.0-rc.1",
"2025.7.0-rc.0",
"2025.7.0-beta.2",
"2025.7.0-beta.1",
"2025.7.0-alpha.0",
"2025.6.4-alpha.4",
"2025.6.4-alpha.3",
"2025.6.4-alpha.2",
"2025.6.4-alpha.1",
"2025.6.4-alpha.0",
"2025.6.3",
"2025.6.3-alpha.0",
"2025.6.2",
"2025.6.2-alpha.0",
"2025.6.1",
"2025.6.1-rc.0",
"2025.6.1-beta.2",
"2025.6.1-beta.1",
"2025.6.1-beta.0",
"2025.6.1-alpha.4",
"2025.6.1-alpha.2",
"2025.6.1-alpha.1",
"2025.6.1-alpha.0",
"2025.6.0",
"2025.6.0-beta.1",
"2025.6.0-beta.0",
"2025.6.0-alpha.0",
"2025.5.1",
"2025.5.1-beta.6",
"2025.5.1-beta.5",
"2025.5.1-beta.4",
"2025.5.1-beta.3",
"2025.5.1-beta.2",
"2025.5.1-beta.1",
"2025.5.1-alpha.5",
"2025.5.1-alpha.4",
"2025.5.1-alpha.3",
"2025.5.1-alpha.2",
"2025.5.1-alpha.1",
"2025.5.1-alpha.0",
"2025.5.0",
"2025.5.0-rc.0",
"2025.5.0-beta.0",
"2025.5.0-alpha.2",
"2025.5.0-alpha.1",
"2025.5.0-alpha.0",
"2025.4.1",
"2025.4.1-rc.0",
"2025.4.1-beta.9",
"2025.4.1-beta.8",
"2025.4.1-beta.7",
"2025.4.1-beta.6",
"2025.4.1-beta.2",
"2025.4.1-beta.0",
"2025.4.1-alpha.2",
"2025.4.1-alpha.1",
"2025.4.1-alpha.0",
"2025.4.0",
"2025.4.0-rc.5",
"2025.4.0-rc.4",
"2025.4.0-rc.0",
"2025.4.0-beta.1",
"2025.4.0-beta.0",
"2025.4.0-alpha.0",
"2025.3.2-beta.21",
"2025.3.2-beta.20",
"2025.3.2-beta.19",
"2025.3.2-beta.17",
"2025.3.2-beta.15",
"2025.3.2-beta.14",
"2025.3.2-beta.13",
"2025.3.2-beta.12",
"2025.3.2-beta.11",
"2025.3.2-beta.10",
"2025.3.2-beta.9",
"2025.3.2-beta.8",
"2025.3.2-beta.5",
"2025.3.2-beta.4",
"2025.3.2-beta.2",
"2025.3.2-beta.1",
"2025.3.2-beta.0",
"2025.3.2-alpha.11",
"2025.3.2-alpha.10",
"2025.3.2-alpha.8",
"2025.3.2-alpha.4",
"2025.3.2-alpha.3",
"2025.3.2-alpha.2",
"2025.3.2-alpha.1",
"2025.3.1",
"2025.3.1-beta.3",
"2025.3.1-beta.2",
"2025.3.1-beta.1",
"2025.3.1-beta.0",
"2025.3.1-alpha.0",
"2025.3.0",
"2025.3.0-beta.2",
"2025.3.0-beta.1",
"2025.3.0-beta.0",
"2025.3.0-alpha.0",
"2025.2.1",
"2025.2.1-beta.2",
"2025.2.1-beta.1",
"2025.2.1-beta.0",
"2025.2.1-alpha.0",
"2025.2.0",
"2025.2.0-beta.1",
"2025.2.0-beta.0",
"2025.2.0-alpha.0",
"2025.1.0",
"2025.1.0-beta.3",
"2025.1.0-beta.2",
"2025.1.0-beta.1",
"2025.1.0-beta.0",
"2025.1.0-alpha.0",
"2024.11.0",
"2024.11.0-beta.4",
"2024.11.0-alpha.3",
"2024.11.0-alpha.2",
"2024.11.0-alpha.1",
"2024.10.2-alpha.2",
"2024.10.2-alpha.1",
"2024.10.2-alpha.0",
"2024.10.1",
"2024.10.1-beta.6",
"2024.10.1-beta.5",
"2024.10.1-beta.4",
"2024.10.1-beta.3",
"2024.10.1-beta.2",
"2024.10.1-beta.1",
"2024.10.1-alpha.0",
"2024.10.0",
"2024.10.0-beta.6",
"2024.10.0-beta.5",
"2024.10.0-beta.4",
"2024.10.0-beta.3",
"2024.10.0-beta.2",
"2024.10.0-alpha.1",
"2024.10.0-alpha.0",
"2024.9.0",
"2024.9.0-beta.14",
"2024.9.0-alpha.13",
"2024.9.0-alpha.12",
"2024.9.0-alpha.11",
"2024.9.0-alpha.10",
"2024.9.0-alpha.9",
"2024.9.0-alpha.8",
"2024.9.0-alpha.7",
"2024.9.0-alpha.6",
"2024.9.0-alpha.5",
"2024.9.0-alpha.4",
"2024.9.0-alpha.3",
"2024.9.0-alpha.2",
"2024.9.0-alpha.1",
"2024.9.0-alpha.0",
"2024.8.0",
"2024.8.0-rc.5",
"2024.8.0-rc.4",
"2024.8.0-rc.3",
"2024.8.0-beta.2",
"2024.8.0-alpha.1",
"2024.8.0-alpha.0",
"2024.7.0",
"2024.7.0-rc.8",
"2024.7.0-rc.7",
"2024.7.0-rc.6",
"2024.7.0-rc.5",
"2024.7.0-rc.4",
"2024.7.0-beta.3",
"2024.7.0-beta.2",
"2024.7.0-beta.1",
"2024.7.0-beta.0",
"2024.2.0-beta.13",
"2024.2.0-beta.12",
"2024.2.0-beta.10",
"2024.2.0-beta.9",
"2024.2.0-beta.8",
"2024.2.0-beta.7",
"2024.2.0-beta.6",
"2024.2.0-beta.5",
"2024.2.0-beta.4",
"2024.2.0-beta.3",
"2024.2.0-beta.2",
"2024.2.0-beta.1",
"2023.12.0-beta.6",
"2023.12.0-beta.5",
"2023.12.0-beta.4",
"2023.12.0-beta.3",
"2023.12.0-beta.2",
"2023.12.0-beta.1",
"2023.11.1-beta.2",
"2023.11.1-beta.1",
"2023.11.0-beta.10",
"2023.11.0-beta.9",
"2023.11.0-beta.8",
"2023.11.0-beta.7",
"2023.11.0-beta.6",
"2023.11.0-beta.5",
"2023.11.0-beta.4",
"2023.11.0-beta.3",
"2023.11.0-beta.2",
"2023.11.0-beta.1",
"2023.10.2-beta.2",
"2023.10.2-beta.1",
"2023.10.0-beta.15",
"2023.10.0-beta.14",
"2023.10.0-beta.13",
"2023.10.0-beta.12",
"2023.10.0-beta.11",
"2023.10.0-beta.10",
"2023.10.0-beta.9",
"2023.10.0-beta.8",
"2023.10.0-beta.7",
"2023.10.0-beta.6",
"2023.10.0-beta.5",
"2023.10.0-beta.4",
"2023.10.0-beta.3",
"2023.10.0-beta.2",
"2023.10.0-beta.1",
"13.14.2",
"2023.9.0-rc.4",
"2023.9.0-rc.3",
"2023.9.0-rc.2",
"2023.9.0-rc.1",
"2023.9.0-beta.11",
"2023.9.0-beta.10",
"2023.9.0-beta.9",
"2023.9.0-beta.8",
"2023.9.0-beta.7",
"2023.9.0-beta.6",
"2023.9.0-beta.5",
"2023.9.0-beta.4",
"2023.9.0-beta.3",
"2023.9.0-beta.2",
"2023.9.0-beta.1",
"13.14.1",
"13.14.0",
"13.13.2",
"13.13.1",
"13.13.0",
"13.12.2",
"13.12.1",
"13.12.0",
"13.11.3",
"13.11.2",
"13.11.1",
"13.11.0",
"13.10.3",
"13.10.2",
"13.10.1",
"13.10.0",
"13.9.2",
"13.9.1",
"13.9.0",
"13.8.1",
"13.8.0",
"13.7.5",
"13.7.4",
"13.7.3",
"13.7.2",
"13.7.1",
"13.7.0",
"13.6.1",
"13.6.0",
"13.5.6",
"13.5.5",
"13.5.4",
"13.5.3",
"13.5.2",
"13.5.1",
"13.5.0",
"13.4.0",
"13.3.4",
"13.3.3",
"13.3.2",
"13.3.1",
"13.3.0",
"13.2.6",
"13.2.5",
"13.2.4",
"13.2.3",
"13.2.2",
"13.2.1",
"13.2.0",
"13.1.8",
"13.1.7",
"13.1.6",
"13.1.5",
"13.1.4",
"13.1.3",
"13.1.2",
"13.1.1",
"13.1.0",
"13.0.0",
"12.119.1",
"12.119.0",
"12.118.1",
"12.118.0",
"12.117.1",
"12.117.0",
"12.116.1",
"12.116.0",
"12.115.0",
"12.114.0",
"12.113.0",
"12.112.3",
"12.112.2",
"12.112.1",
"12.112.0",
"12.111.1",
"12.111.0",
"12.110.1",
"12.110.0",
"12.109.2",
"12.109.1",
"12.109.0",
"12.108.1",
"12.108.0",
"12.107.0",
"12.106.3",
"12.106.2",
"12.106.1",
"12.106.0",
"12.105.0",
"12.104.0",
"12.103.1",
"12.103.0",
"12.102.1",
"12.102.0",
"12.101.1",
"12.101.0",
"12.100.2",
"12.100.1",
"12.100.0",
"12.99.3",
"12.99.2",
"12.99.1",
"12.99.0",
"12.98.0",
"12.97.1",
"12.97.0",
"12.96.1",
"12.96.0",
"12.95.0",
"12.94.1",
"12.94.0",
"12.93.2",
"12.93.1",
"12.93.0",
"12.92.0",
"12.91.0",
"12.90.1",
"12.90.0",
"12.89.2",
"12.89.1",
"12.89.0",
"12.88.0",
"12.87.0",
"12.86.0",
"12.85.1",
"12.85.0",
"12.84.3",
"12.84.2",
"12.84.1",
"12.84.0",
"12.83.0",
"12.82.0",
"12.81.2",
"12.81.1",
"12.81.0",
"12.80.3",
"12.80.2",
"12.80.1",
"12.80.0",
"12.79.3",
"12.79.2",
"12.79.1",
"12.79.0",
"12.78.0",
"12.77.1",
"12.77.0",
"12.76.1",
"12.76.0",
"12.75.1",
"12.75.0",
"12.74.1",
"12.74.0",
"12.73.0",
"12.72.0",
"12.71.0",
"12.70.0",
"12.69.0",
"12.68.0",
"12.67.1",
"12.67.0",
"12.66.0",
"12.65.7",
"12.65.6",
"12.65.5",
"12.65.4",
"12.65.3",
"12.65.2",
"12.65.1",
"12.65.0",
"12.64.2",
"12.64.1",
"12.64.0",
"12.63.0",
"12.62.2",
"12.62.1",
"12.62.0",
"12.61.1",
"12.61.0",
"12.60.1",
"12.60.0",
"12.59.0",
"12.58.0",
"12.57.4",
"12.57.1",
"12.57.0",
"12.56.0",
"12.55.0",
"12.54.0",
"12.53.0",
"12.52.0",
"12.51.0",
"12.50.0",
"12.49.1",
"12.49.0",
"12.48.3",
"12.48.2",
"12.48.1",
"12.48.0",
"12.47.1",
"12.47.0",
"12.46.0",
"12.45.1",
"12.45.0",
"12.44.1",
"12.44.0",
"12.43.0",
"12.42.0",
"12.41.3",
"12.41.2",
"12.41.1",
"12.41.0",
"12.40.0",
"12.39.1",
"12.39.0",
"12.38.1",
"12.38.0",
"12.37.0",
"12.36.1",
"12.36.0",
"12.35.2",
"12.35.1",
"12.35.0",
"12.34.0",
"12.33.0",
"12.32.0",
"12.31.0",
"12.30.0",
"12.29.0",
"12.21.0",
"12.20.0",
"12.19.0",
"12.18.1",
"12.18.0",
"12.17.0",
"12.16.0",
"12.15.0",
"12.14.0",
"12.13.0",
"12.12.0",
"12.11.0",
"12.10.0",
"12.9.0",
"12.8.0",
"12.7.1",
"12.7.0",
"12.6.0",
"12.5.0",
"12.4.1",
"12.4.0",
"12.3.0",
"12.2.0",
"12.1.0",
"12.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104817.json"
}
}
],
"modified": "2026-10-28T02:30:30.654110552Z",
"provider": "osv",
"references": [
"https://github.com/misskey-dev/misskey/releases/tag/2026.7.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104817.json",
"https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8",
"https://nvd.nist.gov/vuln/detail/CVE-2026-104817",
"https://github.com/misskey-dev/misskey/commit/a12ee2e5d72c40252e11a164b2231667c9697667"
],
"provider_metadata": {
"cwe_ids": [
"CWE-405",
"CWE-770",
"CWE-918"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104817.json"
}
},
"related_cves": [
{
"value": "CVE-2026-104817",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 497792,
"published_at": "2026-10-13T18:39:30.169+00:00"
}