Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/fastfeedparser@0.5.2
Typepypi
Namespace
Namefastfeedparser
Version0.5.2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.5.10
Latest_non_vulnerable_version0.5.10
Affected_by_vulnerabilities
0
url VCID-ttr2-9yma-h7eu
vulnerability_id VCID-ttr2-9yma-h7eu
summary FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv="refresh"> tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in 0.5.10.
references
0
reference_url https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37
fixed_packages
0
url pkg:pypi/fastfeedparser@0.5.10
purl pkg:pypi/fastfeedparser@0.5.10
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/fastfeedparser@0.5.10
aliases CVE-2026-39376, GHSA-4gx2-pc4f-wq37, PYSEC-2026-60
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ttr2-9yma-h7eu
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/fastfeedparser@0.5.2