CVE-2026-55248

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55248
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55248.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55248
Aliases
Published
2026-08-28T18:40:50Z
Modified
2026-09-11T03:30:42Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H CVSS Calculator
Summary
plone.app.portlets: Denial of service via RSS feed portlet
Details

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55248.json"
}
References

Affected packages

Git / github.com/plone/plone.app.portlets

Affected ranges

Type
GIT
Repo
https://github.com/plone/plone.app.portlets
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
285447dda504f8bbd6c06b34c5dff42df2cb857d
Introduced
d8bbcbea3a278d4c34e5f8339c102b137733e6b9
Fixed
7276bf16644ef7613d9b7c0166312cf6cd903bc1
Fixed
452f243477dea33650dde251cc747628fd69e060
Fixed
f4735a02b397652d8232d6e7f07a30845facfdcc
Fixed
09da52ef7b297daa8e0cfd2361e47c37d9b073ad
Fixed
9f16b6fb10211916686c6c346ea174bf517e3fbd
Fixed
a3b2c2887165b308cd915cbb87b8276f90a76680
Fixed
df5e256baee55083cbd6b9a2623675d4cb26b6cd
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.8"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.4"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.0
2.0.1
2.0.2
2.0a1
2.0a2
2.0a3
2.0a4
2.0b1
2.0b10
2.0b11
2.0b2
2.0b3
2.0b4
2.0b5
2.0b6
2.0b7
2.0b8
2.0b9
2.1.0
2.1.2
2.1.3
2.1.4
2.1.5
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.3
2.3.1
2.3a1
2.4.0
2.4.1
2.4.2
2.5.0
2.5a1
3.*
3.0
3.0.1
3.0.10
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1
3.1.1
3.1.2
3.1.3
4.*
4.0.0
4.1.0
4.1.1
4.1.2
4.2
4.2.1
4.2.2
4.2.3
4.3.0
4.3.1
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
5.*
5.0.0
5.0.0a1
5.0.0a10
5.0.0a2
5.0.0a3
5.0.0a4
5.0.0a5
5.0.0a6
5.0.0a7
5.0.0a8
5.0.0a9
5.0.0b1
5.0.0b2
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
6.*
6.0.0
6.0.1
6.0.2
6.0.3
7.*
7.0.0
7.0.1
Other
iteration1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55248.json"