CVE-2026-103937

Deferred Deferred - Pending Action

Storage Exhaustion via Uncleaned File Uploads in Misskey

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103937

EUVD

EUVD-2026-99240

Affected Vendors & Products

Vendor	Product	Version / Range
misskey-dev	misskey	>= 12.0.0, <= 13.14.2
misskey-dev	misskey	>= 2023.9.0-beta.1, < 2025.4.1
misskey-dev	misskey	>= 2025.5.0, < 2026.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

Executive Summary

This vulnerability affects Misskey servers running versions 13.0.0 to 2025.4.1 and 2025.5.0 to 2026.7.0. It involves incomplete cleanup of temporary files during file uploads, causing storage or file descriptor exhaustion. This leads to denial of service as repeated uploads fill up resources regardless of federation status.

Impact Analysis

The vulnerability can cause your Misskey server to run out of storage space or file descriptors due to unremoved temporary files from uploads. This may lead to service disruptions, crashes, or inability to accept new uploads, affecting all users of the server.

Mitigation Strategies

Upgrade Misskey to version 2026.7.0 or later to fix the incomplete cleanup during file uploads that causes storage exhaustion.

Hi! I’m here to help you understand CVE-2026-103937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70