CVE-2026-55248

Received Received - Intake

Memory Exhaustion via RSS Feed in Plone.app.portlets

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55248

EUVD

EUVD-2026-67864

Affected Vendors & Products

Vendor	Product	Version / Range
plone	plone.app.portlets	to 5.0.8 (inc)
plone	plone.app.portlets	to 6.0.4 (inc)
plone	plone.app.portlets	to 7.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-55248 is a denial of service (DoS) vulnerability in plone.app.portlets affecting Plone versions. Authenticated members can exploit the RSS feed portlet by setting a feed URL to a very large response, consuming excessive memory and causing service disruption. It also allows server-side request forgery (SSRF) to probe internal networks and stored cross-site scripting (XSS) via malicious JavaScript URLs in feed items.

Detection Guidance

Check for Plone versions using vulnerable plone.app.portlets (5.0.0-5.0.7, 6.0.0-6.0.3, 7.0.0-7.0.1). Inspect RSS portlet configurations for unusually large feed URLs or suspicious JavaScript links. Monitor memory usage spikes during RSS feed processing. Review logs for repeated failed feed retrievals or internal network probes.

Impact Analysis

This vulnerability can lead to denial of service, making the system unavailable. It may allow attackers to probe internal networks for open ports, access internal services, or inject malicious scripts that execute when victims view the feed. Confidentiality and integrity of data may also be compromised.

Mitigation Strategies

Upgrade plone.app.portlets to patched versions (5.0.8, 6.0.4, or 7.0.2). Restrict portlet management permissions to trusted users only. Disable or unregister the RSS portlet if unused. Set MAXIMUM_RSS_FEED_SIZE_BYTES to a lower value (e.g., 100000) in environment variables.

Hi! I’m here to help you understand CVE-2026-55248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70