Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Hollo :hollo:@hollo@hollo.social (2026-09-27 19:26:15)
Hollo security updates: 0.8.12 and 0.9.19
If you run Hollo, update to a patched release now.  Fedify has disclosed three vulnerabilities that affect Hollo: CVE-2026-96625, a critical actor impersonation vulnerability; CVE-2026-96623, a high-severity denial-of-service vulnerability in remote document parsing; and CVE-2026-96624, a medium-severity server-side request forgery vulnerability in outbound activity delivery.  Treat the actor impersonation issue as an immediate upgrade: anyone on the internet could have an activity accepted by your Hollo inbox as coming from any actor.

For CVE-2026-96625, Fedify verified the signature on an incoming activity, but trusted the signing key document's own claim about whom the key belonged to. An attacker with an ordinary HTTP server could serve a key document naming any actor as its owner and have activities accepted under that actor's identity.  No account on the receiving Hollo instance was required.  The same flaw affected signed-key ownership checks used to restrict access to posts, allowing a forged key document to pass those checks under another actor's identity.

The fix resolves the claimed owner's actor document and requires it to link back to the key.  It also validates the origin of fetched actor documents. Fedify's built-in key cache automatically stops reading entries whose ownership had not been verified, so Hollo operators do not need to clear that cache manually.

For CVE-2026-96623, Fedify parsed JSON bodies without a byte limit, including inbox bodies and remote documents such as keys, actors, objects, JSON-LD contexts, WebFinger descriptors, and NodeInfo documents.  An attacker could exhaust memory and CPU with a large body, including a compressed response that expanded substantially before parsing.  An inbound body limit at a reverse proxy did not protect the outbound fetch paths.

The fix limits JSON bodies to 16 MiB after decompression.  Oversized inbox requests receive HTTP 413, and remote JSON documents