SSRF in Lemmynet Lemmy

CVE-2026-29178

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/…

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.003 (19.2th percentile) — read the EPSS interpretation.