Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

activitypub_federation

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5crates.ioPublished

    Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

    CVE-2026-33693 · GHSA-q537-8fr5-cw35

    Affected
    • crates.io activitypub_federation < 0.7.0-beta.9
    Fixed in
    0.7.0-beta.9· Vendor fix available
    Issue
    The v4isinvalid() function in activitypub-federation-rust (src/utils.rs) does not check for Ipv4Addr::UNSPECIFIED (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server. Details File: src/utils.rs in activitypub-federation-rust Function: v4isinvalid(v4: Ipv4Addr) - bool The function checks isprivate(), isloopback(), islinklocal(), ismulticast(), and isdocumentation() — but omits isunspecified(). On Linux, macOS, and Windows, TCP connections to 0.0.0.0 are routed to localhost (127.0.0.1). Additionally, ::ffff:0.0.0.0 (IPv4-mapped IPv6) also bypasses because v6isinvalid() calls toipv4mapped().issomeand(v4isinvalid), inheriting the same gap. Notably, v6isinvalid() already includes isunspecified() for native IPv6, making this an asymmetric oversight. Independent secondary finding — DNS Rebinding TOCTOU:…

    Recommended action: Upgrade to 0.7.0-beta.9 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →