VulnSocial

CVE-2026-49328Disclosure(apache / fesod)

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch apache fesod systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to version 2.0.2-incubating, which fixes this issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • fesod

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-06-02)
  • 3 total mentions across 2 days

Affected systems

Vendors
apache
Products
fesod

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-01: 1Mentions · 2026-06-02: 2Patch / Workaround · 2026-06-02: 1Technical Details · 2026-06-01: 1Technical Details · 2026-06-02: 206-0106-02
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-011
Disclosure1
2026-06-022
Disclosure1Patch1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    CVE-2026-49328: Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF https://www.openwall.com/lists/oss-security/2026/06/01/4

    Post summary

    Apache Fesod (Incubating) has a disclosed CVE-2026-49328 involving SSRF due to improper URL validation, announced via an Openwall mailing‑list discussion.

    00020332
    4.7K followersView on X
  • Gray Hats@the_yellow_fall
    Patch

    A critical Apache Fesod SSRF vulnerability has been found. Learn about the CVE-2026-49328 patch released to protect internal network resources. #ApacheFesod #SSRF #CVE202649328 #JavaSecurity #Cybersecurity https://securityonline.info/apache-fesod-ssrf-vulnerability-cve-2026-49328/ https://t.co/qDLIIvvLCX

    Post summary

    The post announces a critical SSRF vulnerability in Apache Fesod (CVE‑2026‑49328) and highlights that a patch has been released to protect internal network resources.

    00010345
    12.2K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-49328 Server-Side Request Forgery in Apache Fesod UrlImageConverter Before 2.0.2-Incubating https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49328

    Post summary

    The post announces a newly identified Server‑Side Request Forgery vulnerability in Apache Fesod UrlImageConverter (pre‑2.0.2‑Incubating) without indicating exploitation, patches, or mitigation details.

    0000049
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachefesod---

Explore more

Back to dashboardapache CVEsfesod vulnerabilities