FastFeedParser performs URL parsing without limiting nested meta-refresh redirects, allowing an attacker to craft a server that returns an infinite chain of HTML pages each with a <meta http-equiv="refresh"> tag. The parser recurses indefinitely into those redirects, eventually exhausting the Python call stack and crashing the consuming process. This vulnerability is identified as a stack-based Denial of Service condition rooted in CWE‑674, Stack Based Buffer Overflow.

The affected product is the FastFeedParser library from Kagisearch, commonly integrated in Python applications that process RSS, Atom, or RDF feeds. Versions prior to 0.5.10 are vulnerable; upgrading to 0.5.10 or later resolves the recursion problem.

The CVSS base score is 7.5, indicating a substantial risk. The EPSS score is below 1 %, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. An attacker must control a URL that FastFeedParser will fetch and host an endless meta‑refresh loop; reaching internal network resources can be achieved by chaining this issue with the existing SSRF flaw, making the attack more damaging if internal targets are reachable.