PT-2026-3901 · Mastodon · Mastodon

Daprice · Publicado 2026-01-22 · Atualizado 2026-02-03 · CVE-2026-23963

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.5.5 Mastodon versions prior to 4.4.12 Mastodon versions prior to 4.3.18

Description Mastodon, a free and open-source social network server based on ActivityPub, does not limit the length of names for lists or filters, or for filter keywords. This allows a user to set an excessively long string as a name or keyword, potentially causing disproportionate storage and computing resource usage. A user can render their own web interface unusable, though this requires intentional action or approval of a malicious API client.

Recommendations Update to Mastodon version 4.5.5 or later. Update to Mastodon version 4.4.12 or later. Update to Mastodon version 4.3.18 or later.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BIT-MASTODON-2026-23963

CVE-2026-23963

GHSA-6X3W-9G92-GVF3

Produtos afetados

Mastodon

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23963.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3 · Aviso do Fabricante
• https://github.com/mastodon/mastodon/releases/tag/v4.4.12 · Nota
• https://github.com/mastodon/mastodon/releases/tag/v4.3.18 · Nota
• https://github.com/mastodon/mastodon/releases/tag/v4.5.5 · Nota
• https://twitter.com/lsof/status/2014399172284187075 · Publicação no Twitter
• https://t.me/cveNotify/149511 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-23963 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-23963 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2014253738500722775 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014182492195189196 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-mastodon-2026-23963 · Aviso do Fabricante
• https://t.me/CVEtracker/42718 · Publicação no Telegram