Misskey EUVD-2026-99239

No special conditions - remote unauthenticated exploitation against default configurations of Misskey, because the fetch-rss API is publicly reachable and, in affected versions (12.112.1 through pre-2026.7.0), had no rate limiting, no response-size cap, and no concurrency limit. The flaw is exploitable even when federation is disabled, removing a common mitigating assumption. The only limiting factors are that the instance must expose the API to the attacker (standard for a running Misskey server) and that impact is resource exhaustion/amplification/probing rather than code execution or direct data theft; upgrading to 2026.7.0 fully remediates it.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a genuinely low-barrier flaw: network-reachable, low complexity, no authentication, no user interaction - any internet host can hit the fetch-rss endpoint. The impact profile is primarily availability (VA:H) with secondary low confidentiality/availability on other systems (SC:L/SA:L), consistent with CWE-405 (asymmetric resource consumption) rather than data theft; the 'Information Disclosure' tag overstates the confidentiality angle, which is limited to network reconnaissance via outbound-request probing. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active exploitation - this is a high-CVSS issue whose real-world priority is tempered by the absence of exploitation signals and by the product's modest deployment footprint. The 8.7 score is driven by trivial exploitability plus amplification/DoS potential, not by severe direct impact; treat as a meaningful patch priority for exposed Misskey instances but not an emergency on par with KEV-listed RCEs. Conflicting signal to note: the tag labels this 'Information Disclosure' while the CVSS and description both point to resource exhaustion and SSRF-style probing as the dominant effects.

An unauthenticated attacker repeatedly calls the public fetch-rss API with crafted URLs, forcing the Misskey instance to open unbounded concurrent outbound HTTP requests and perform synchronous XML parsing until CPU, sockets, or memory are exhausted. By pointing the URL at a third-party server the attacker turns the instance into a request-amplification relay, and by targeting internal/RFC1918 addresses they can probe which network services are reachable even when federation is disabled. No public exploit was identified at time of analysis, but the fix commit confirms the missing rate limit, size cap, and concurrency cap that made this trivially abusable.