{"cve":"CVE-2026-39376","nvd":{"published":"2026-04-07T20:16:32.450","modified":"2026-07-24T21:10:00.143","status":"Analyzed","description":"FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv=\"refresh\"> tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in 0.5.10.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-674"],"references":["https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37","https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37"],"products":["kagi:fastfeedparser"],"source":"nvd","synced_at":"2026-10-19T22:28:59.047572785+00:00"},"epss":{"cve":"CVE-2026-39376","score":0.00328,"percentile":0.25978,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4gx2-pc4f-wq37","url":"https://osv.dev/vulnerability/GHSA-4gx2-pc4f-wq37","summary":"FastFeedParser has an infinite redirect loop DoS via meta-refresh chain","modified":"2026-06-06T00:30:10.262659159Z","packages":[{"ecosystem":"PyPI","name":"fastfeedparser","purl":"pkg:pypi/fastfeedparser","ranges":["<0.5.10"],"fixed":["0.5.10"]}]},{"id":"PYSEC-2026-60","url":"https://osv.dev/vulnerability/PYSEC-2026-60","summary":"","modified":"2026-05-20T09:19:00.162749Z","packages":[{"ecosystem":"PyPI","name":"fastfeedparser","purl":"pkg:pypi/fastfeedparser","ranges":["<0.5.10"],"fixed":["0.5.10"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}