CVE-2026-33693: Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
(updated )
The v4_is_invalid() function in activitypub-federation-rust (src/utils.rs) does not check for Ipv4Addr::UNSPECIFIED (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server.
References
- github.com/LemmyNet/activitypub-federation-rust
- github.com/LemmyNet/activitypub-federation-rust/commit/4ae8532b17bc35755240b7f55d4a5b7665351599
- github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35
- github.com/advisories/GHSA-7723-35v7-qcxw
- github.com/advisories/GHSA-q537-8fr5-cw35
- nvd.nist.gov/vuln/detail/CVE-2026-33693
Code Behaviors & Features
Detect and mitigate CVE-2026-33693 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →