Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M

CVE-2026-33693Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

Medium 6.5

In plain English

A medium-severity server-side request forgery in lemmy from LemmyNet. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 68.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/utils.rs`) does not check for `Ipv4Addr::UNSPECIFIED` (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server. Version 0.7.0-beta.9 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
LemmyNet	lemmy	< 0.7.0-beta.9

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35 x_refsource_CONFIRM
https://github.com/LemmyNet/activitypub-federation-rust/commit/4ae8532b17bc35755240b7f55d4a5b7665351599 x_refsource_MISC
https://github.com/advisories/GHSA-7723-35v7-qcxw x_refsource_MISC