{"items":[{"id":"NVI-00018587","kind":"vulnerability","title":"FastFeedParser has an infinite redirect loop DoS via meta-refresh chain","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4gx2-pc4f-wq37","CVE-2026-39376"],"plain_summary":"GitHub lists this reviewed advisory for fastfeedparser. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-405d51a5c7467cac407ffb260b4c45fd"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-06T00:24:06.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-405d51a5c7467cac407ffb260b4c45fd"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-405d51a5c7467cac407ffb260b4c45fd","url":"https://github.com/advisories/GHSA-4gx2-pc4f-wq37","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-4gx2-pc4f-wq37","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:52:58.259Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-405d51a5c7467cac407ffb260b4c45fd"],"technology":"fastfeedparser","known_exclusions":[],"conditions_summary":"### Summary\nWhen `parse()` fetches a URL that returns an HTML page containing a `` tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check.\n\n\n### Details\n`parse()` catches `ValueError` on XML parse failure, extracts a meta-refresh URL from the HTML response via `_extract_meta_refresh_url()`, and tail-calls itself with that URL. The recursive call is unconditional — there is no maximum redirect depth, no set of already-visited URLs, and no guard against self-referential or looping redirects.\n\n**`fastfeedparser/main.py` — `parse()` (recursive sink):**\n```python\ndef parse(source: str | bytes, ...) -> FastFeedParserDict:\n    is_url = isinstance(source, str) and source.startswith((\"http://\", \"https://\"))\n    if is_url:\n        content = _fetch_url_content(source)\n    t","public_affected_ranges":["<= 0.5.9"]}],"null_published_at":"2026-11-07T07:07:39.858Z","source_updated_at":"2026-06-06T00:24:06.000Z","source_disclosed_at":"2026-04-08T00:12:26.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:52:58.259Z"}],"next_cursor":null,"snapshot_revision":"42594"}