Log in Start free

Vulnerability · Published Aug 28, 2026 · Assigned by GitHub_M

CVE-2026-55248plone.app.portlets: Denial of service via RSS feed portlet

Critical 9.1

In plain English

A critical-severity uncontrolled resource consumption in plone.app.portlets from plone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.4%top 61.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIplone-app-portlets7.0.2GHSA-x5g3-w747-2h8q
PyPIplone-app-portlets6.0.4GHSA-x5g3-w747-2h8q
PyPIplone-app-portlets5.0.8GHSA-x5g3-w747-2h8q
PyPIplone-app-portlets5.0.8, 6.0.4, 7.0.2PYSEC-2026-3884

Affected products (as reported)

VendorProductVersions
plone plone.app.portlets < 5.0.8>= 6.0.0, < 6.0.4>= 7.0.0, < 7.0.2

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

References