CVE-2026-33693

MEDIUM

Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-33693. PoCs published by SnailSploit.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-33693, an SSRF vulnerability in the `activitypub-federation-rust` library due to incomplete IP validation in the `v4_is_invalid()` function, which fails to block `0.0.0.0`. The writeup includes vulnerable code snippets, attack chain, impact analysis, and remediation steps.

Description

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/utils.rs`) does not check for `Ipv4Addr::UNSPECIFIED` (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server. Version 0.7.0-beta.9 patches the issue.

Exploits (1)

nomisec WRITEUP
by SnailSploit · poc
https://github.com/SnailSploit/CVE-2026-33693

This repository provides a detailed technical analysis of CVE-2026-33693, an SSRF vulnerability in the `activitypub-federation-rust` library due to incomplete IP validation in the `v4_is_invalid()` function, which fails to block `0.0.0.0`. The writeup includes vulnerable code snippets, attack chain, impact analysis, and remediation steps.

Classification
Writeup 100%
Attack Type
Ssrf
Complexity
Trivial
Reliability
Reliable
Target: activitypub-federation-rust <= 0.7.1
No auth needed
Prerequisites: Access to a vulnerable Lemmy or downstream project instance
mistral-large-3 · analyzed Apr 28, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 6.5
EPSS 0.0036
EPSS Percentile 28.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (2)
crates.io/activitypub_federation 0 - 0.7.0-beta.9crates.io
LemmyNet/lemmy < 0.7.0-beta.9
Published Mar 27, 2026
Tracked Since Mar 27, 2026