Apache Fesod: SSRF protection bypass via DNS rebinding in UrlImageConverter
Summary
Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding in the SSRF protection of the UrlImageConverter component. The converter validates the resolved IP addresses of a hostname but then opens a separate connection that may resolve the hostname again. An attacker who controls DNS responses for an image URL hostname can reach restricted internal addresses after validation, provided the application accepts attacker-controlled image URLs when writing spreadsheets.
Affected
- fesod-sheet 2.0.2-incubating (Maven: org.apache.fesod:fesod-sheet)
- Default configuration: unaffected according to the CVE record
- Versions before 2.0.2-incubating: unknown in scope of this CVE (see CVE-2026-49328)
Fixed in
- Apache Fesod (Incubating) 2.1.0-incubating
- Remote URL image fetching is disabled by default and requires an explicit exact-host allowlist when enabled
Workaround
- Disable remote URL image fetching in the application if it is not required
- If it is required, allow only hostnames whose DNS and HTTP services are fully trusted; this reduces but does not eliminate the risk
- Restrict outbound HTTP and HTTPS from the application server so it cannot reach internal networks or cloud metadata addresses
Exploitation
- No active exploitation known at the time of writing
- No public proof of concept found
- CISA SSVC assessment: Exploitation none, Automatable yes, Technical Impact total
- The CVSS 9.1 score is not yet verified; NVD analysis was pending
Our recommendation
- Upgrade fesod-sheet to 2.1.0-incubating
- Find all applications using fesod-sheet and check whether remote URL image fetching is enabled
- Until the upgrade is done, apply the workarounds listed above
- Monitor outbound requests from the application for connections to internal addresses
- Check the NVD entry once analysis is complete to confirm the severity
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Fesod blog: CVE-2026-107460 advisory fesod.apache.org
- OSV: CVE-2026-107460 osv.dev
- GitHub pull request #1035: require an allowlist for remote URL images github.com
- GitHub release Apache Fesod 2.1.0-incubating github.com
- Apache mailing list thread lists.apache.org
- Vulners: CVE-2026-107460 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:48.
Original description (NVD)
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.