CVE-2026-33693

CVE-2026-33693: activitypub-federation-rust v4isinvalid의 0.0.0.0 우회를 통한 SSRF CVSS 6.5 Moderate 키워드: SSRF, 0.0.0.0, IP 검증 우회, activitypub-federation, Lemmy, Rust, ActivityPub 목차 개요 취약점 상세 기술 분석 공격 체인 영향 해결 방법 CVSS v3.1 지표 타임라인 참고 자료 연락처 면책 조항 개요 activitypub-federation-rust 라이브러리Lemmy 및 6개 이상의 하위...

CVE-2026-33693

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the v4isinvalid function in activitypub-federation-rust src/utils.rs does not check for Ipv4Addr::UNSPECIFIED 0.0.0.0. An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the...

CVE-2026-33693: Server-Side Request Forgery (SSRF)

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the v4isinvalid function in activitypub-federation-rust src/utils.rs does not check for Ipv4Addr::UNSPECIFIED 0.0.0.0. An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the...