FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/FreshRSS/FreshRSS/commit/7d4854a0a4f5665db599f18c34035786465639f3 Patch
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78 Exploit, Patch, Vendor Advisory
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78 Exploit, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · freshrssNVD modified 2026-10-13 09:10
Affected (CPE criteria) 1
cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*
References 4
- https://github.com/FreshRSS/FreshRSS/commit/7d4854a0a4f5665db599f18c34035786465639f3 Patch
- https://github.com/FreshRSS/FreshRSS/pull/8029 Issue Tracking
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78 Exploit, Patch, Vendor Advisory
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78 Exploit, Patch, Vendor Advisory