CVE-2026-103937: high-severity vulnerability in misskey-dev misskey
Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
misskey-dev · misskeyRelated CVEs — misskey-dev misskey
In the same product, most dangerous first.
CVE-2021-39195HIGHServer-Side Request Forgery vulnerability in misskeyEPSS 1.1%CVE-2023-43793HIGHMisskey allows users to bypass authentication of Bull dashboardEPSS 0.8%CVE-2021-39169HIGHXSS vulnerability using dialogEPSS 0.7%CVE-2023-24812HIGHSQL injection of notes/search-by-tagEPSS 0.7%CVE-2024-25636HIGHLack of media type verification of Activity Streams objects allows impersonation and takeover of remote accountsEPSS 0.7%CVE-2026-104816HIGHMisskey: Cross-site scripting in RSS feed item linksEPSS 0.6%