FastFeedParser is a high‑performance RSS, Atom and RDF parser. In versions before 0.5.10 the parse() method follows HTTP redirects delivered by <meta http‑equiv="refresh"> tags without any depth limit or visited‑URL tracking. An attacker that controls a server can return an infinite chain of meta‑refresh responses. The parser then recurses unboundedly, exhausting the Python call stack and crashing the process. Because the parser accepts any URL, the same chain can be combined with the SSRF flaw in the companion issue to reach internal network destinations after bypassing the URL check.

The vulnerability affects the kagisearch:fastfeedparser library for all releases before 0.5.10. No specific operating system or platform is mentioned; the issue is in the parser code itself. Users that incorporate fastfeedparser in their applications, particularly those that process untrusted URLs, are potentially exposed.

The issue carries a CVSS score of 7.5, indicating a high severity level. No EPSS value is provided, and it is not listed in CISA’s KEV catalog, so the public exploitation likelihood has not been quantified. However, the attacker only needs to supply a malicious URL; the library will attempt to fetch it, making the risk high for systems that call parse() on user‑supplied data. If the attacker also exploits the SSRF side channel, internal resources become reachable, raising the potential impact.