CVE Feed

    Dashboard / CVE / CVE-2026-33693

    CVE-2026-33693

    Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/utils.rs`) does not check for `Ipv4Addr::UNSPECIFIED` (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server. Version 0.7.0-beta.9 patches the issue.

    Published:Mar 27, 2026
    Last Modified:Mar 30, 2026
    EPS:Mar 27, 2026
    EPSS Score:0.00044
    CVSS Score:6.5

    Affected Products

    Vendor
    Lemmynet
    Product
    Lemmy

    Exploits

    https://github.com/SnailSploit/CVE-2026-33693

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-54738 (CVSS 6.5) — Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web Connectio…
    CVE-2026-54743 (CVSS 6.4) — Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui re…
    CVE-2026-54739 (CVSS 6.9) — Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpo…
    CVE-2026-54740 (CVSS 6.5) — Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked re…
    CVE-2026-54741 (CVSS 5.3) — Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new …
    CVE-2026-54742 (CVSS 5.1) — Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a commu…
    CVE-2026-42180 (CVSS 6.3) — Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticate…
    CVE-2026-42181 (CVSS 6.5) — Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for u…
    CVE-2026-29178 (CVSS 7.7) — Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a depen…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High