Hollo security updates: 0.8.12 and 0.9.19

If you run Hollo, update to a patched release now. Fedify has disclosed three vulnerabilities that affect Hollo: CVE-2026-96625, a critical actor impersonation vulnerability; CVE-2026-96623, a high-severity denial-of-service vulnerability in remote document parsing; and CVE-2026-96624, a medium-severity server-side request forgery vulnerability in outbound activity delivery. Treat the actor impersonation issue as an immediate upgrade: anyone on the internet could have an activity accepted by your Hollo inbox as coming from any actor.

For CVE-2026-96625, Fedify verified the signature on an incoming activity, but trusted the signing key document's own claim about whom the key belonged to. An attacker with an ordinary HTTP server could serve a key document naming any actor as its owner and have activities accepted under that actor's identity. No account on the receiving Hollo instance was required. The same flaw affected signed-key ownership checks used to restrict access to posts, allowing a forged key document to pass those checks under another actor's identity.

The fix resolves the claimed owner's actor document and requires it to link back to the key. It also validates the origin of fetched actor documents. Fedify's built-in key cache automatically stops reading entries whose ownership had not been verified, so Hollo operators do not need to clear that cache manually.

For CVE-2026-96623, Fedify parsed JSON bodies without a byte limit, including inbox bodies and remote documents such as keys, actors, objects, JSON-LD contexts, WebFinger descriptors, and NodeInfo documents. An attacker could exhaust memory and CPU with a large body, including a compressed response that expanded substantially before parsing. An inbound body limit at a reverse proxy did not protect the outbound fetch paths.

The fix limits JSON bodies to 16 MiB after decompression. Oversized inbox requests receive HTTP 413, and remote JSON documents larger than this limit are rejected.

For CVE-2026-96624, outbound activity delivery validated neither the inbox URL advertised by a remote actor nor its redirect destinations. A remote actor could point its inbox at a loopback address, a link-local cloud metadata service, or a private network host, or redirect delivery there. On the RSA delivery path, the redirected request remained a POST carrying the activity body and was re-signed for the internal host.

The fix validates the initial destination and every redirect target before sending a request. This is a separate path from the authenticated document loader fixed in the previous Hollo security update. Hollo's existing ALLOW_PRIVATE_ADDRESS=true option still permits private destinations, including private inbox URLs and redirect targets. Use it only in test environments or closed federations where you control the remote actors.

For full technical details, see the Fedify security advisories for CVE-2026-96625, CVE-2026-96623, and CVE-2026-96624, and the Fedify security announcement.

All Hollo versions in the supported 0.8.x and 0.9.x release lines up to and including 0.8.11 and 0.9.18 are affected. Patched releases are 0.8.12 for the 0.8.x series and 0.9.19 for the 0.9.x series, incorporating Fedify 2.1.24 and 2.2.13 respectively.

Hollo 0.7.x is also affected. It and earlier release lines are no longer supported under the Hollo security policy. Upgrade to a supported release series rather than remaining on an older version.

For 0.8.x deployments, update to 0.8.12:

docker pull ghcr.io/fedify-dev/hollo:0.8.12

For 0.9.x deployments, update to 0.9.19:

docker pull ghcr.io/fedify-dev/hollo:0.9.19

After pulling the new image, restart your Hollo container. If you deploy from source, pull the corresponding release tag and restart.

Thanks to @kaimandalic and @morealLee Dogeon for independently reporting the actor impersonation issue, to @kaimandalic for reporting the unbounded document parsing issue, and to @euriconicacio for reporting the outbound delivery SSRF issue, and to all three for their responsible disclosure to the Fedify project.

If anything is unclear, ask below.