{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "5.0.8"
              },
              {
                "introduced": "6.0.0"
              },
              {
                "fixed": "6.0.4"
              },
              {
                "introduced": "7.0.0"
              },
              {
                "fixed": "7.0.2"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "introduced": "285447dda504f8bbd6c06b34c5dff42df2cb857d"
            },
            {
              "introduced": "d8bbcbea3a278d4c34e5f8339c102b137733e6b9"
            },
            {
              "fixed": "7276bf16644ef7613d9b7c0166312cf6cd903bc1"
            },
            {
              "fixed": "452f243477dea33650dde251cc747628fd69e060"
            },
            {
              "fixed": "f4735a02b397652d8232d6e7f07a30845facfdcc"
            },
            {
              "fixed": "09da52ef7b297daa8e0cfd2361e47c37d9b073ad"
            },
            {
              "fixed": "9f16b6fb10211916686c6c346ea174bf517e3fbd"
            },
            {
              "fixed": "a3b2c2887165b308cd915cbb87b8276f90a76680"
            },
            {
              "fixed": "df5e256baee55083cbd6b9a2623675d4cb26b6cd"
            }
          ],
          "repo": "https://github.com/plone/plone.app.portlets",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-x5g3-w747-2h8q"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55248.json"
  },
  "details": "plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.",
  "id": "CVE-2026-55248",
  "modified": "2026-09-11T03:30:42.985360753Z",
  "published": "2026-08-28T18:40:50.582Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55248.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/plone/plone.app.portlets/security/advisories/GHSA-x5g3-w747-2h8q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55248"
    },
    {
      "type": "FIX",
      "url": "https://github.com/plone/plone.app.portlets/commit/09da52ef7b297daa8e0cfd2361e47c37d9b073ad"
    },
    {
      "type": "FIX",
      "url": "https://github.com/plone/plone.app.portlets/commit/9f16b6fb10211916686c6c346ea174bf517e3fbd"
    },
    {
      "type": "FIX",
      "url": "https://github.com/plone/plone.app.portlets/commit/a3b2c2887165b308cd915cbb87b8276f90a76680"
    },
    {
      "type": "FIX",
      "url": "https://github.com/plone/plone.app.portlets/commit/df5e256baee55083cbd6b9a2623675d4cb26b6cd"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "plone.app.portlets: Denial of service via RSS feed portlet"
}