The FastFeedParser component of kagisearch before version 0.5.10 suffers from an uncontrolled recursion vulnerability (CWE-674). Specifically, when the parse() function encounters an HTML page containing a <meta http-equiv="refresh"> tag, it recursively invokes itself with the redirect URL without any safeguards such as recursion depth limits, visited URL deduplication, or redirect count caps. This allows an attacker-controlled server to cause infinite recursion, leading to Python call stack exhaustion and process crash. Additionally, this vulnerability can be chained with a companion SSRF vulnerability to reach internal network targets after bypassing initial URL checks. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) and is resolved in FastFeedParser version 0.5.10.

Exploitation results in denial of service by crashing the process due to stack exhaustion from unbounded recursion. There is no direct confidentiality or integrity impact described. However, when combined with an SSRF vulnerability, it may facilitate internal network access, potentially increasing attack surface. No known exploits in the wild have been reported.

Upgrade FastFeedParser to version 0.5.10 or later, where this uncontrolled recursion vulnerability is fixed. Since no official remediation level or patch link is provided, verify the upgrade availability from the vendor or project repository. Avoid using affected versions (<0.5.10) in production environments. Patch status is not explicitly confirmed beyond the version fix note; check vendor advisories for the latest remediation guidance.