plone.app.portlets Package Vulnerability: Denial of Service Threat
- Severity
- HIGH
- Affected component
- plone.app.portlets (pypi)
- Affected versions
- >= 7.0.0, <= 7.0.1 or >= 6.0.0, < 6.0.4 or < 5.0.8
- Patched version
- 7.0.2 || 6.0.4 || 5.0.8
An early warning has been issued for a denial of service vulnerability in the plone.app.portlets package. Users of affected versions are advised to upgrade.
What happened
An early warning has been issued regarding a vulnerability in the plone.app.portlets package that could lead to a denial of service attack. This vulnerability, tracked as GHSA-X5G3-W747-2H8Q and CVE-2026-55248, allows an attacker to cause a denial of service by adding an RSS portlet with a link to a large file. The issue has been patched in the latest versions of plone.app.portlets.
The affected versions include plone.app.portlets >= 7.0.0, <= 7.0.1 or >= 6.0.0, < 6.0.4 or < 5.0.8. Users of these versions should assess their exposure and take appropriate action to mitigate the risk.
What to do about it
- Upgrade to the latest version of plone.app.portlets: 7.0.2 for Plone 6.2, 6.0.4 for Plone 6.1, or 5.0.8 for Plone 6.0.
- Review your current usage of plone.app.portlets and identify any instances where RSS feed portlets are used.
- Implement additional security measures to monitor and restrict the size of files that can be linked via RSS feed portlets.
- Consult the primary sources for the most up-to-date information and patches.
How 0Day would have caught this
plone.app.portlets is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using plone.app.portlets >= 7.0.0, <= 7.0.1 or >= 6.0.0, < 6.0.4 or < 5.0.8.
What should I do right now?
Upgrade to the latest version of plone.app.portlets: 7.0.2 for Plone 6.2, 6.0.4 for Plone 6.1, or 5.0.8 for Plone 6.0.
Is this vulnerability being exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time.
Where can I find more information about this vulnerability?
Consult the primary sources: [GHSA-x5g3-w747-2h8q](https://github.com/advisories/GHSA-x5g3-w747-2h8q) for the latest details and patches.