PT-2026-3901 · Mastodon · Mastodon

Daprice · Published 2026-01-22 · Updated 2026-02-03 · CVE-2026-23963

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.5.5 Mastodon versions prior to 4.4.12 Mastodon versions prior to 4.3.18

Description Mastodon, a free and open-source social network server based on ActivityPub, does not limit the length of names for lists or filters, or for filter keywords. This allows a user to set an excessively long string as a name or keyword, potentially causing disproportionate storage and computing resource usage. A user can render their own web interface unusable, though this requires intentional action or approval of a malicious API client.

Recommendations Update to Mastodon version 4.5.5 or later. Update to Mastodon version 4.4.12 or later. Update to Mastodon version 4.3.18 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-MASTODON-2026-23963

CVE-2026-23963

GHSA-6X3W-9G92-GVF3

Affected Products

Mastodon

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23963.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23963 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23963 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mastodon-2026-23963 · Vendor Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.4.12 · Note
• https://github.com/mastodon/mastodon/releases/tag/v4.3.18 · Note
• https://github.com/mastodon/mastodon/releases/tag/v4.5.5 · Note
• https://twitter.com/lsof/status/2014399172284187075 · Twitter Post
• https://t.me/cveNotify/149511 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014253738500722775 · Twitter Post
• https://twitter.com/CVEnew/status/2014182492195189196 · Twitter Post
• https://t.me/CVEtracker/42718 · Telegram Post