What is the CVSS score of CVE-2026-39376?

CVE-2026-39376 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-39376?

FastFeedParser, a Python RSS/Atom parsing library used in feed aggregation and content management applications, is vulnerable to remote denial-of-service attacks through malicious meta-refresh…. A patch is available.

How to fix or mitigate CVE-2026-39376?

Within 24 hours: identify all applications and systems using FastFeedParser (check requirements.txt, pip freeze, and dependency manifests) and document version numbers in use. Within 7 days: implement URL validation and parsing timeout controls; restrict parse() operations to trusted feed sources only; and monitor upstream FastFeedParser GitHub repository for patch release (target version 0.5.10 or later when available). Within 30 days: evaluate alternative RSS/Atom parsing libraries with active security maintenance, or apply strict recursion depth limits at the application layer as a compensating control pending patch availability.

Python CVE-2026-39376

EUVD-2026-19915 HIGH

Uncontrolled Recursion (CWE-674)

2026-04-07 GitHub_M

GHSA-4gx2-pc4f-wq37

SSRF Python

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 08, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19915

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:46 nvd

HIGH 7.5

DescriptionGitHub Advisory

FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv="refresh"> tag, it recursively calls itself with the redirect URL - with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in 0.5.10.

AnalysisAI

Unbounded recursion in FastFeedParser (Python RSS/Atom parser) allows remote attackers to crash applications via malicious HTML meta-refresh redirect chains. Affecting all versions prior to 0.5.10, attackers can trigger denial-of-service by serving infinite meta-refresh redirects when parse() fetches attacker-controlled URLs, exhausting the Python call stack with no recursion depth limit. EPSS data not available, no public exploit identified at time of analysis, but exploit development is trivial given the straightforward attack vector requiring only HTTP server control.

Technical ContextAI

FastFeedParser is a Python library for parsing RSS, Atom, and RDF feed formats developed by Kagi Search. The vulnerability stems from improper handling of HTTP meta-refresh redirects (HTML <meta http-equiv="refresh"> tags) in the URL fetching logic. When parse() encounters such tags, it recursively calls itself with the redirect target URL without implementing standard safeguards: no maximum recursion depth limit, no visited-URL tracking to prevent cycles, and no redirect count cap. This violates CWE-674 (Uncontrolled Recursion), a class of vulnerabilities where unbounded recursive function calls exhaust system resources. The Python call stack has finite depth (typically ~1000 frames by default), making stack exhaustion achievable with relatively few redirects. The advisory notes this can be chained with a companion SSRF vulnerability, suggesting the parser may follow redirects to internal network addresses after initial URL validation, compounding the attack surface.

RemediationAI

Upgrade FastFeedParser to version 0.5.10 or later, which implements recursion depth limits and redirect count caps to prevent stack exhaustion attacks. Organizations should update via pip (pip install --upgrade fastfeedparser) and verify the installed version is 0.5.10+. For environments unable to immediately upgrade, implement application-layer mitigations: enforce strict timeouts on parse() calls using Python's signal module or threading.Timer, validate and whitelist acceptable feed source domains before passing URLs to parse(), and deploy process-level resource limits (ulimit stack size, container resource constraints) to contain crash impact. Review application architecture to ensure feed parsing occurs in isolated worker processes rather than critical request handlers. The complete vendor advisory with patch details is available at https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37, and organizations should review the companion SSRF advisory referenced to address the full attack chain.