Misskey’s fetch‑rss API, available to unauthenticated users, lacks any rate limiting or size restrictions and performs synchronous XML parsing. This allows an attacker to issue unlimited outbound HTTP requests and XML processing calls, which can drain instance CPU, memory, and network bandwidth. The unbounded requests can also amplify traffic toward third‑party web servers and enable an attacker to probe internal network services even when federation is disabled, potentially revealing service endpoints and port information.

The affected product is the Misskey federated social media platform developed by misskey‑dev. Versions 12.112.1 through 2026.7.0, inclusive, contain the vulnerability. The fix was introduced in release 2026.7.0, which reintroduces rate limiting, size limits, and mitigates unbounded parsing.

The CVSS score of 8.7 indicates a high severity risk. No EPSS score is available, and the vulnerability is not listed on the CISA KEV catalog, but the lack of authentication and the need for no special prerequisites mean that any external actor can exploit the flaw by sending repeated RSS fetch requests. Successful exploitation can lead to sustained resource exhaustion, denial of service, and opportunistic network probing. The absence of rate limiting also opens the door for a small number of well‑timed requests to cause major denial of service impact on the host system.