Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-33693 EUVD-2026-16494GHSA-q537-8fr5-cw35

Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

Published Mar 27, 2026 · Updated Mar 30, 2026 · Assigned by GitHub_M

Vendor: LemmyNet Product: lemmy Package: activitypub_federation Ecosystem: crates.io

Description

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/utils.rs`) does not check for `Ipv4Addr::UNSPECIFIED` (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server. Version 0.7.0-beta.9 patches the issue.

Affected products

VendorProductAffectedFixed
LemmyNet lemmy < 0.7.0-beta.9 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • SnailSploit/CVE-2026-33693 ★ 2 · Mar 23, 2026

    CVE-2026-33693: SSRF via 0.0.0.0 Bypass in activitypub-federation-rust v4_is_invalid() (CVSS 6.5 Moderate)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io activitypub_federation < 0.7.0-beta.9 0.7.0-beta.9 GHSA-q537-8fr5-cw35

References