# CVE-2026-55248: plone.app.portlets: Denial of service via RSS feed portlet > Attackers can cause denial of service via large RSS feeds and perform SSRF to probe internal networks in Plone RSS portlets. - **Severity:** Critical 9.1 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 28 Aug 2026 - **Updated:** 28 Aug 2026 - **Also known as:** GHSA-x5g3-w747-2h8q, PYSEC-2026-3884 ## What is CVE-2026-55248? CVE-2026-55248 is a critical server-side request forgery vulnerability in plone.app.portlets, published on 28 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim. ### Official description plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2. Weakness: CWE-400 (Uncontrolled Resource Consumption) ## Which versions are affected by CVE-2026-55248? 7 open source packages ship an affected version, including plone.app.portlets and plone-app-portlets. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `plone.app.portlets` | PyPI | All versions | 5.0.8 | | `plone.app.portlets` | PyPI | From 6.0.0 | 6.0.4 | | `plone.app.portlets` | PyPI | From 7.0.0 | 7.0.2 | | `plone-app-portlets` | PyPI | All versions | 5.0.8, 6.0.4, 7.0.2 | | `plone-app-portlets` | PyPI | All versions | 5.0.8 | | `plone-app-portlets` | PyPI | From 6.0.0 | 6.0.4 | | `plone-app-portlets` | PyPI | From 7.0.0 | 7.0.2 | ## How do I fix CVE-2026-55248? Upgrade plone.app.portlets to a fixed version for your release line: 5.0.8, 6.0.4 or 7.0.2. ## Is CVE-2026-55248 being exploited? There is no known exploitation of CVE-2026-55248 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-55248 and fix it if it is affected. What it is: CVE-2026-55248 is a critical server-side request forgery vulnerability in plone.app.portlets, published on 28 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2026-55248 in the wild and no public exploit code. Affected packages and fixed versions: - plone.app.portlets (PyPI): affected all versions; fixed in 5.0.8 - plone.app.portlets (PyPI): affected from 6.0.0; fixed in 6.0.4 - plone.app.portlets (PyPI): affected from 7.0.0; fixed in 7.0.2 - plone-app-portlets (PyPI): affected all versions; fixed in 5.0.8, 6.0.4, 7.0.2 - plone-app-portlets (PyPI): affected all versions; fixed in 5.0.8 - plone-app-portlets (PyPI): affected from 6.0.0; fixed in 6.0.4 - plone-app-portlets (PyPI): affected from 7.0.0; fixed in 7.0.2 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-55248/ (Markdown: https://insights.sbomify.com/CVE-2026-55248/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-55248 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55248 - OSV: https://osv.dev/vulnerability/CVE-2026-55248 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-55248/ Summaries are generated and may contain mistakes; the official description above is the record.