Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FastFeedParser has an infinite redirect loop DoS via meta-refresh chain
Vulnerability Description
FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv="refresh"> tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in 0.5.10.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
未经控制的递归
Vulnerability Title
FastFeedParser 安全漏洞
Vulnerability Description
FastFeedParser是Kagi Search开源的一个高性能的Python RSS与Atom解析库。 FastFeedParser 0.5.10之前版本存在安全漏洞，该漏洞源于解析HTML元刷新标签时缺少递归深度限制，可能导致无限递归和进程崩溃。
CVSS Information
N/A
Vulnerability Type
N/A