High severity · published Oct 13, 2026
CVE-2026-104817
Misskey: Lack of rate limiting and size restrictions in RSS fetching API
8.7
CVSS
0.5%
EPSS
No
On KEV
Description
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
misskey · misskey-dev
>= 12.0.0, <= 13.14.2; >= 2023.9.0-beta.1, < 2026.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104817
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104817
x_refsource_CONFIRM
https://github.com/misskey-dev/misskey/security/advisories/GHSA-4x7v-qx8f-g3p8
x_refsource_MISC
https://github.com/misskey-dev/misskey/commit/a12ee2e5d72c40252e11a164b2231667c9697667
x_refsource_MISC
https://github.com/misskey-dev/misskey/releases/tag/2026.7.0
More from misskey
9.3
CVE-2024-52591
Missing validation allows spoofed profiles and notes in Misskey
9.2
CVE-2026-46713
Misskey: JSON-LD signature validation + compaction may lead to improper activity handling
8.9
CVE-2026-47746
Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks
8.7
CVE-2026-103937
Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
8.5
CVE-2026-104816
Misskey: Cross-site scripting in RSS feed item links