CVE-2026-103937

{
  "etk_id": "ETK-2026-1493",
  "cve_id": "CVE-2026-103937",
  "display_id": "CVE-2026-103937",
  "ghsa_id": "GHSA-m9xp-2fvm-pfmq",
  "euvd_id": "EUVD-2026-99240",
  "status": "published",
  "anchor_state": "anchored",
  "title": "File-upload resource exhaustion denial of service in Misskey",
  "summary": "Misskey versions in the affected release ranges can fail to reclaim resources associated with uploaded files. An attacker able to repeatedly upload files may exhaust storage or file descriptors and disrupt service; federation does not need to be enabled.",
  "mitigation": "Upgrade to 2025.4.1 if using the 2025.4 release line, or upgrade to 2026.7.0 or later. Restrict or rate-limit untrusted file uploads until the update is deployed.",
  "vendor": "misskey-dev",
  "product": "misskey",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=13.0.0 <2025.4.1",
        ">=2025.5.0"
      ],
      "ecosystem": "n/a",
      "fixed_versions": [
        "2026.7.0"
      ],
      "package_name": "Misskey",
      "purl": null
    }
  ],
  "cwes": [
    459
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.005,
  "epss_percentile": 0.4172,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 20.371506616666668,
  "t0_at": "2026-10-13T18:42:17.022000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-13T19:29:00.820322+00:00",
      "days": 0.03245136946759259,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T18:42:17.022000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-13T18:42:17.022000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T18:42:17.022000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103937"
    }
  }
}