CVE-2026-104817

{
  "etk_id": "ETK-2026-1494",
  "cve_id": "CVE-2026-104817",
  "display_id": "CVE-2026-104817",
  "ghsa_id": "GHSA-4x7v-qx8f-g3p8",
  "euvd_id": "EUVD-2026-99239",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated RSS fetch resource exhaustion in Misskey",
  "summary": "Misskey versions 12.112.1 through versions before 2026.7.0 expose an RSS-fetch API that does not sufficiently constrain request volume or response size. An unauthenticated attacker can cause outbound requests and parsing work that exhaust instance resources, amplify traffic to other systems, or reach services accessible from the instance; federation need not be enabled.",
  "mitigation": "Upgrade the misskey package to version 2026.7.0 or later. Until the upgrade is complete, restrict unauthenticated access to the RSS-fetch API to reduce exposure.",
  "vendor": "misskey-dev",
  "product": "misskey",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 12.112.1"
      ],
      "ecosystem": "n/a",
      "fixed_versions": [
        "2026.7.0"
      ],
      "package_name": "Misskey",
      "purl": null
    }
  ],
  "cwes": [
    405
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:N/SA:L",
  "epss_score": 0.0046,
  "epss_percentile": 0.3852,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 22.850485733333333,
  "t0_at": "2026-10-13T18:39:30.169000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-13T19:52:28.176167+00:00",
      "days": 0.05067137924768519,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T18:39:30.169000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-13T18:39:30.169000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T18:39:30.169000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104817"
    }
  }
}