CVE-2026-33693

CVE-2026-33693: SSRF via 0.0.0.0 Bypass no activitypub-federation-rust v4isinvalid CVSS 6.5 Moderado Palavras-chave: SSRF, 0.0.0.0, bypass de validação de IP, activitypub-federation, Lemmy, Rust, ActivityPub Índice Overview Vulnerability Details Technical Analysis Attack Chain Impact Remediation...

CVE-2026-33693

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the v4isinvalid function in activitypub-federation-rust src/utils.rs does not check for Ipv4Addr::UNSPECIFIED 0.0.0.0. An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the...