CVE-2026-103937CWE-459

CVE-2026-103937

published October 13, 2026

CVSS
8.7
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00501 · 42.1th percentile
Weakness
CWE-459 · Incomplete Cleanup
Published
2026-10-13T23:17Z
References (4)
https://github.com/misskey-dev/misskey/commit/3f28489fb856e6e07a16290f3ea1e1261572b527 · [email protected]https://github.com/misskey-dev/misskey/pull/17750 · [email protected]https://github.com/misskey-dev/misskey/releases/tag/2026.7.0 · [email protected]https://github.com/misskey-dev/misskey/security/advisories/GHSA-m9xp-2fvm-pfmq · [email protected]
EPSS history
Timeline
  • 15 OCT 03:28Z
    EPSS moved — → 1%
    epss
  • 13 OCT 18:42Z
    Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
    cvelistv5
  • 13 OCT 18:42Z
    Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
    cvelistv5