CVE-2026-33693

🗓️ 27 Mar 2026 00:03:35Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 47 Views🌐 WEB

CVE-2026-33693: Lemmy SSRF via 0.0.0.0 in activitypub-federation-rust; localhost access, fixed in 0.7.0-beta.9.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-33693	27 Mar 202600:03	–	attackerkb
Circl	CVE-2026-33693	23 Mar 202615:39	–	circl
CNNVD	Lemmy 代码问题漏洞	27 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-33693 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()	27 Mar 202600:03	–	cvelist
Github Security Blog	Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()	25 Mar 202620:23	–	github
GitLab Advisory Database	Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()	25 Mar 202600:00	–	gitlab
NVD	CVE-2026-33693	27 Mar 202601:16	–	nvd
OSV	CVE-2026-33693 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()	27 Mar 202600:03	–	osv
OSV	GHSA-7723-35V7-QCXW Server-Side Request Forgery (SSRF) in activitypub_federation	10 Feb 202520:25	–	osv
OSV	GHSA-Q537-8FR5-CW35 Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()	25 Mar 202620:23	–	osv

Vulners

Node

lemmynet lemmyRange<0.7.0-beta.9

[
  {
    "vendor": "LemmyNet",
    "product": "lemmy",
    "versions": [
      {
        "version": "< 0.7.0-beta.9",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/LemmyNet/activitypub-federation-rust/commit/4ae8532b17bc35755240b7f55d4a5b7665351599
github	www.github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35
github	www.github.com/advisories/GHSA-7723-35v7-qcxw

Parameter	Position	Path	Description	CWE
object	request body	0.0.0.0:<port>/path	SSRF via 0.0.0.0 bypass by embedding a URL to 0.0.0.0 in ActivityPub payload	CWE-918
attachment	request body	0.0.0.0:<port>/path	SSRF via 0.0.0.0 bypass by embedding a URL to 0.0.0.0 in ActivityPub payload	CWE-918
href	request body	0.0.0.0:<port>/path	SSRF via 0.0.0.0 bypass by embedding a URL to 0.0.0.0 in ActivityPub payload	CWE-918
@context	path	inbox	SSRF payload delivery endpoint used by ActivityPub ingestion (inbox)	CWE-918
type	path	inbox	SSRF payload delivery endpoint used by ActivityPub ingestion (inbox)	CWE-918
id	path	inbox	SSRF payload delivery endpoint used by ActivityPub ingestion (inbox)	CWE-918
actor	path	inbox	SSRF payload delivery endpoint used by ActivityPub ingestion (inbox)	CWE-918
to	path	inbox	SSRF payload delivery endpoint used by ActivityPub ingestion (inbox)	CWE-918
object	path	inbox	SSRF payload delivery endpoint used by ActivityPub ingestion (inbox)	CWE-918
attachment	path	inbox	SSRF payload delivery endpoint used by ActivityPub ingestion (inbox)	CWE-918

17 Jun 2026 10:37Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

EPSS0.00359

SSVC

CWE-918