CVE-2026-33693 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-33693?
CVE-2026-33693 is a medium-severity vulnerability in LemmyNet lemmy, published on 27 Mar 2026.
Official description
Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/utils.rs`) does not check for `Ipv4Addr::UNSPECIFIED` (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server. Version 0.7.0-beta.9 patches the issue.
Weakness: CWE-918
Which versions are affected by CVE-2026-33693?
2 open source packages ship an affected version, including activitypub_federation.
| Package | Affected | Fixed in |
|---|---|---|
activitypub_federation crates.io | All versions | 0.7.0-beta.9 |
activitypub_federation crates.io | All versions | 0.7.0-beta.9 |
How do I fix CVE-2026-33693?
Upgrade activitypub_federation to 0.7.0-beta.9 or later.
Is CVE-2026-33693 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33693 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-q537-8fr5-cw35.