CVE-2026-39376

FastFeedParser is affected by CVE-2026-39376 prior to version 0.5.10. When parse() fetches a URL returning an HTML page with a tag, it may recursively call itself on the redirect URL without a depth limit, visited-URL deduplication, or redirect count cap. An attacker-controlled server that emits...

CVE-2026-39376 FastFeedParser has an infinite redirect loop DoS via meta-refresh chain

FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse fetches a URL that returns an HTML page containing a tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An...