Not yet scoredPublished Oct 13, 2026

CVE-2026-107460Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects Apache Software Foundation Apache Fesod (Incubating). Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache Fesod (Incubating)

Exploited in the last 30 days

Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.

CVSS: Not yet scored
Weakness (CWE): CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: apache
NVD analysis: Awaiting Analysis
Record last updated: Oct 13, 2026
First seen by InfoSec Signals: Oct 13, 2026

Affected products

Affected products

Apache Software Foundation Apache Fesod (Incubating) apache_software_foundation:apache_fesod_incubating (from the name)	2.0.2-incubating	CNA record

References

https://github.com/apache/fesod/pull/1035patch
https://github.com/apache/fesod/releases/tag/2.1.0-incubatingrelease-notes
https://cve.org/CVERecord?id=CVE-2026-49328related
https://lists.apache.org/thread/oh706yhm32hmw8vx4kh1948h952pfr83vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.