CVE-2026-33693

{
    "cve": {
        "id": "CVE-2026-33693",
        "cveTags": [],
        "metrics": {
            "cvssMetricV31": [
                {
                    "type": "Secondary",
                    "source": "security-advisories@github.com",
                    "cvssData": {
                        "scope": "UNCHANGED",
                        "version": "3.1",
                        "baseScore": 6.5,
                        "attackVector": "NETWORK",
                        "baseSeverity": "MEDIUM",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                        "integrityImpact": "LOW",
                        "userInteraction": "NONE",
                        "attackComplexity": "LOW",
                        "availabilityImpact": "NONE",
                        "privilegesRequired": "NONE",
                        "confidentialityImpact": "LOW"
                    },
                    "impactScore": 2.5,
                    "exploitabilityScore": 3.9
                }
            ]
        },
        "published": "2026-03-27T01:16:18.983",
        "references": [
            {
                "url": "https://github.com/LemmyNet/activitypub-federation-rust/commit/4ae8532b17bc35755240b7f55d4a5b7665351599",
                "source": "security-advisories@github.com"
            },
            {
                "url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35",
                "source": "security-advisories@github.com"
            },
            {
                "url": "https://github.com/advisories/GHSA-7723-35v7-qcxw",
                "source": "security-advisories@github.com"
            }
        ],
        "vulnStatus": "Deferred",
        "weaknesses": [
            {
                "type": "Primary",
                "source": "security-advisories@github.com",
                "description": [
                    {
                        "lang": "en",
                        "value": "CWE-918"
                    }
                ]
            }
        ],
        "descriptions": [
            {
                "lang": "en",
                "value": "Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/utils.rs`) does not check for `Ipv4Addr::UNSPECIFIED` (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server. Version 0.7.0-beta.9 patches the issue."
            },
            {
                "lang": "es",
                "value": "Lemmy es un agregador de enlaces y un foro para el fediverso. Antes de la versi\u00f3n 0.7.0-beta.9, la funci\u00f3n `v4_is_invalid()` de `activitypub-federation-rust` (`src/utils.rs`) no comprueba si existe `Ipv4Addr::UNSPECIFIED` (0.0.0.0). Un atacante no autenticado que controle un dominio remoto puede apuntarlo a 0.0.0.0, eludir la protecci\u00f3n SSRF introducida por la correcci\u00f3n para CVE-2025-25194 (GHSA-7723-35v7-qcxw) y acceder a los servicios de localhost en el servidor de destino. La versi\u00f3n 0.7.0-beta.9 corrige el problema."
            }
        ],
        "lastModified": "2026-04-28T21:14:50.743",
        "sourceIdentifier": "security-advisories@github.com"
    }
}