{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-23221",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-23221",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-01-20T16:49:31.738Z",
    "updatedAt": "2025-01-21T14:49:49.806Z",
    "importedAt": "2026-10-24T01:57:29.455Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism",
      "summary": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security mechanisms, and forcing the victim’s server into an infinite loop causing Denial of Service. Moreover, this issue can also be maneuvered into performing a Blind SSRF attack. This vulnerability is fixed in 1.0.14, 1.1.11, 1.2.11, and 1.3.4.",
      "affected": [
        {
          "vendor": "dahlia",
          "product": "fedify",
          "versions": [
            {
              "version": "< 1.0.14",
              "status": "affected"
            },
            {
              "version": ">= 1.1.0, < 1.1.11",
              "status": "affected"
            },
            {
              "version": ">= 1.2.0, < 1.2.11",
              "status": "affected"
            },
            {
              "version": ">= 1.3.0, < 1.3.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}