CVE-2026-39376

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39376", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-06T21:29:17.350Z", "datePublished": "2026-04-07T19:46:08.816Z", "dateUpdated": "2026-04-08T19:22:49.417Z"}, "containers": {"cna": {"title": "FastFeedParser has an infinite redirect loop DoS via meta-refresh chain", "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "lang": "en", "description": "CWE-674: Uncontrolled Recursion", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37"}], "affected": [{"vendor": "kagisearch", "product": "fastfeedparser", "versions": [{"version": "< 0.5.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T19:46:08.816Z"}, "descriptions": [{"lang": "en", "value": "FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv=\"refresh\"> tag, it recursively calls itself with the redirect URL \u2014 with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in 0.5.10."}], "source": {"advisory": "GHSA-4gx2-pc4f-wq37", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T19:17:44.454321Z", "id": "CVE-2026-39376", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:22:49.417Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39376", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T19:17:44.454321Z"}}}], "references": [{"url": "https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:17:58.606Z"}}], "cna": {"title": "FastFeedParser has an infinite redirect loop DoS via meta-refresh chain", "source": {"advisory": "GHSA-4gx2-pc4f-wq37", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "kagisearch", "product": "fastfeedparser", "versions": [{"status": "affected", "version": "< 0.5.10"}]}], "references": [{"url": "https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37", "name": "https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv=\"refresh\"> tag, it recursively calls itself with the redirect URL \u2014 with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in 0.5.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674: Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T19:46:08.816Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39376", "state": "PUBLISHED", "dateUpdated": "2026-04-08T19:22:49.417Z", "dateReserved": "2026-04-06T21:29:17.350Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T19:46:08.816Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fastfeedparser", "vendor": "kagisearch", "versions": [{"status": "affected", "version": "< 0.5.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kagi:fastfeedparser:*:*:*:*:*:python:*:*", "matchCriteriaId": "772491C0-4451-46D0-93E7-14946CD0286B", "versionEndExcluding": "0.5.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv=\"refresh\"> tag, it recursively calls itself with the redirect URL \u2014 with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in 0.5.10."}, {"lang": "es", "value": "FastFeedParser es un analizador de alto rendimiento para RSS, Atom y RDF. Antes de la versi\u00f3n 0.5.10, cuando parse() obtiene una URL que devuelve una p\u00e1gina HTML que contiene una etiqueta <meta http-equiv=\"refresh\">, se llama a s\u00ed mismo recursivamente con la URL de redirecci\u00f3n - sin l\u00edmite de profundidad, sin deduplicaci\u00f3n de URL visitadas y sin l\u00edmite de recuento de redirecciones. Un servidor controlado por un atacante que devuelve una cadena infinita de respuestas HTML meta-refresh causa una recursi\u00f3n ilimitada, agotando la pila de llamadas de Python y bloqueando el proceso. Esta vulnerabilidad tambi\u00e9n puede encadenarse con el problema SSRF asociado para alcanzar objetivos de red internos despu\u00e9s de eludir la verificaci\u00f3n inicial de la URL. Esta vulnerabilidad se corrige en la versi\u00f3n 0.5.10."}], "id": "CVE-2026-39376", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39376", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T19:17:44.454321Z", "version": "2.0.3"}}]}, "published": "2026-04-07T20:16:32.450", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.5.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "fastfeedparser", "source": "cna", "vendor": "kagisearch"}, "product": "fastfeedparser", "vendor": "kagisearch"}], "analysis": {"en": {"generated_at": "2026-04-14T21:42:17.069523+00:00", "value": {"mitigation_remediation": ["Upgrade FastFeedParser to version\u00a00.5.10 or higher.", "Prior to calling parse(), validate the URL against a whitelist of trusted domains to prevent remote content from being fetched.", "If an upgrade is delayed, implement a wrapper around parse() that limits the recursion depth or removes meta\u2011refresh handling to stop the infinite loop."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected product is the FastFeedParser library from Kagisearch, commonly integrated in Python applications that process RSS, Atom, or RDF feeds. Versions prior to 0.5.10 are vulnerable; upgrading to 0.5.10 or later resolves the recursion problem.", "description_and_impact": "FastFeedParser performs URL parsing without limiting nested meta-refresh redirects, allowing an attacker to craft a server that returns an infinite chain of HTML pages each with a <meta http-equiv=\"refresh\"> tag. The parser recurses indefinitely into those redirects, eventually exhausting the Python call stack and crashing the consuming process. This vulnerability is identified as a stack-based Denial of Service condition rooted in CWE\u2011674, Stack Based Buffer Overflow.", "risk_and_exploitability": "The CVSS base score is 7.5, indicating a substantial risk. The EPSS score is below 1\u202f%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. An attacker must control a URL that FastFeedParser will fetch and host an endless meta\u2011refresh loop; reaching internal network resources can be achieved by chaining this issue with the existing SSRF flaw, making the attack more damaging if internal targets are reachable."}}}}, "created": "2026-04-08T19:34:36.278995+00:00", "updated": "2026-04-15T16:15:11.971136+00:00", "vendors": ["kagisearch", "kagisearch$PRODUCT$fastfeedparser"]}