CVE-2026-55248: CWE-400: Uncontrolled Resource Consumption in plone plone.app.portlets

The plone.app.portlets component, which provides portlets and a Plone-specific UI for plone.portlets, contains a vulnerability identified as CVE-2026-55248. Before versions 5.0.8, 6.0.4, and 7.0.2, a user able to add an RSS portlet can specify an RSS feed URL that returns a very large response. This causes the rss.py module to download and retain excessive data in memory, resulting in denial of service due to uncontrolled resource consumption (CWE-400). The RSS URL handling logic accepts internal network addresses and ports, enabling server-side requests that can probe internal services and open ports (SSRF). Furthermore, malicious feed items can embed JavaScript URLs as item links, which execute scripts when used by victims. The vulnerability involves functions such as _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA cache. The issue is resolved in versions 5.0.8, 6.0.4, and 7.0.2.

An attacker with permission to add an RSS portlet can cause a denial of service by forcing the server to download and hold large amounts of data in memory. The vulnerability also allows server-side request forgery to internal network hosts and ports, potentially exposing internal services. Additionally, malicious JavaScript URLs in feed items can lead to script execution in victim browsers. The CVSS score of 9.1 indicates critical severity with impacts on availability, confidentiality, and integrity.

This vulnerability is fixed in plone.app.portlets versions 5.0.8, 6.0.4, and 7.0.2. Users should upgrade to these or later versions to remediate the issue. No official patch or workaround is indicated beyond upgrading. Until patched, restrict permissions to add RSS portlets to trusted users only.