{"cve":"CVE-2026-103937","nvd":{"published":"2026-10-13T19:17:54.387","modified":"2026-10-16T20:04:29.760","status":"Deferred","description":"Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":null,"cwes":["CWE-459"],"references":["https://github.com/misskey-dev/misskey/commit/3f28489fb856e6e07a16290f3ea1e1261572b527","https://github.com/misskey-dev/misskey/pull/17750","https://github.com/misskey-dev/misskey/releases/tag/2026.7.0","https://github.com/misskey-dev/misskey/security/advisories/GHSA-m9xp-2fvm-pfmq"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:58:52.678897993+00:00"},"epss":{"cve":"CVE-2026-103937","score":0.00501,"percentile":0.42637,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}