CVE-2026-33693: Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
(updated )
The v4_is_invalid() function in activitypub-federation-rust (src/utils.rs) does not check for Ipv4Addr::UNSPECIFIED (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server.
References
- github.com/LemmyNet/activitypub-federation-rust
- github.com/LemmyNet/activitypub-federation-rust/commit/4ae8532b17bc35755240b7f55d4a5b7665351599
- github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35
- github.com/advisories/GHSA-7723-35v7-qcxw
- github.com/advisories/GHSA-q537-8fr5-cw35
- nvd.nist.gov/vuln/detail/CVE-2026-33693
Code Behaviors & Features
Detect and mitigate CVE-2026-33693 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →