High, CVSS 7.5PyPIAmendedPublished
FastFeedParser has an infinite redirect loop DoS via meta-refresh chain
CVE-2026-39376 · GHSA-4gx2-pc4f-wq37
- Affected
- PyPI fastfeedparser <= 0.5.9
- Fixed in
- 0.5.10· Vendor fix available
- Issue
- When parse() fetches a URL that returns an HTML page containing a <meta http-equiv="refresh" tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. Details parse() catches ValueError on XML parse failure, extracts a meta-refresh URL from the HTML response via extractmetarefreshurl(), and tail-calls itself with that URL. The recursive call is unconditional — there is no maximum redirect depth, no set of already-visited URLs, and no guard against self-referential or looping redirects. fastfeedparser/main.py — parse() (recursive sink): extractmetarefreshurl() uses urljoin(baseurl,…
Recommended action: Upgrade to 0.5.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.