Is CVE-2026-103937 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103937 being exploited in the wild.

How severe is CVE-2026-103937?

Informational severity, published 13 October 2026.

Which products and versions are affected?

Misskey 13.0.0 to 2025.4.1, 2025.5.0 to 2026.7.0.

Is there a fix for CVE-2026-103937?

Yes: fixed in 2026.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103937 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-103937?

Check whether you run Misskey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103937: Misskey multipart API cleanup denial of service

CVE-2026-103937 · Severity: info · Published 2026-10-13

Misskey is a federated social media platform. A flaw in file upload processing prevents temporary files from being cleaned up, allowing attackers to exhaust server storage or file descriptors through repeated uploads, causing service outages. This affects all instances regardless of federation settings.

Technologies: Misskey. Vendors: Misskey.

Quick answers

Is CVE-2026-103937 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103937 being exploited in the wild.
How severe is CVE-2026-103937?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Misskey 13.0.0 to 2025.4.1, 2025.5.0 to 2026.7.0.
Is there a fix for CVE-2026-103937?: Yes: fixed in 2026.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103937 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-103937?: Check whether you run Misskey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.7.0

Technical details

The multipart API fails to delete temporary directories after handling file uploads, particularly on error conditions. Attackers can repeatedly upload files to accumulate temporary artifacts, exhausting storage capacity or file descriptor limits and triggering denial of service. The issue is resolved by properly cleaning up temporary directories after multipart API processing completes.

Affected products

Misskey Misskey 13.0.0 to 2025.4.1, 2025.5.0 to 2026.7.0

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.