Lemmy 代码问题漏洞

🗓️ 27 Mar 2026 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 3 Views

Lemmy before 0.7.0-beta.9 had a v4_isInvalid flaw that ignored 0.0.0.0, bypassing SSRF protection.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-33693	27 Mar 202600:03	–	attackerkb
Circl	CVE-2026-33693	23 Mar 202615:39	–	circl
CVE	CVE-2026-33693	27 Mar 202600:03	–	cve
Cvelist	CVE-2026-33693 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()	27 Mar 202600:03	–	cvelist
Github Security Blog	Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()	25 Mar 202620:23	–	github
GitLab Advisory Database	Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()	25 Mar 202600:00	–	gitlab
NVD	CVE-2026-33693	27 Mar 202601:16	–	nvd
OSV	CVE-2026-33693 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()	27 Mar 202600:03	–	osv
OSV	GHSA-7723-35V7-QCXW Server-Side Request Forgery (SSRF) in activitypub_federation	10 Feb 202520:25	–	osv
OSV	GHSA-Q537-8FR5-CW35 Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()	25 Mar 202620:23	–	osv

Source	Link
github	www.github.com/LemmyNet/activitypub-federation-rust/commit/4ae8532b17bc35755240b7f55d4a5b7665351599
github	www.github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35
github	www.github.com/advisories/GHSA-7723-35v7-qcxw

29 May 2026 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5

EPSS0.00022

SSVC

Lemmy versions v4_isInvalid server side request forgery