CVE-2026-23962

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23962", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T14:49:06.313Z", "datePublished": "2026-01-22T01:51:37.430Z", "dateUpdated": "2026-01-22T21:35:41.343Z"}, "containers": {"cna": {"title": "Mastodon vulnerable to Denial of Service from a single post (client/server)", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-gg8q-rcg7-p79g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-gg8q-rcg7-p79g"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5"}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"version": "< 4.3.18", "status": "affected"}, {"version": ">= 4.4.0, < 4.4.12", "status": "affected"}, {"version": ">= 4.5.0, < 4.5.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T01:51:37.430Z"}, "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the maximum number of poll options for remote posts, allowing attackers to create polls with a very large amount of options, greatly increasing resource consumption. Depending on the number of poll options, an attacker can cause disproportionate resource usage in both Mastodon servers and clients, potentially causing Denial of Service either server-side or client-side. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched."}], "source": {"advisory": "GHSA-gg8q-rcg7-p79g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T21:34:54.544661Z", "id": "CVE-2026-23962", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T21:35:41.343Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23962", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T14:49:06.313Z", "datePublished": "2026-01-22T01:51:37.430Z", "dateUpdated": "2026-01-22T21:35:41.343Z"}, "containers": {"cna": {"title": "Mastodon vulnerable to Denial of Service from a single post (client/server)", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-gg8q-rcg7-p79g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-gg8q-rcg7-p79g"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5"}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"version": "< 4.3.18", "status": "affected"}, {"version": ">= 4.4.0, < 4.4.12", "status": "affected"}, {"version": ">= 4.5.0, < 4.5.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T01:51:37.430Z"}, "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the maximum number of poll options for remote posts, allowing attackers to create polls with a very large amount of options, greatly increasing resource consumption. Depending on the number of poll options, an attacker can cause disproportionate resource usage in both Mastodon servers and clients, potentially causing Denial of Service either server-side or client-side. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched."}], "source": {"advisory": "GHSA-gg8q-rcg7-p79g", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23962", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T21:34:54.544661Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T21:35:36.721Z"}}]}}

{"affected": [{"affectedData": [{"product": "mastodon", "vendor": "mastodon", "versions": [{"status": "affected", "version": "< 4.3.18"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.12"}, {"status": "affected", "version": ">= 4.5.0, < 4.5.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ADDA491-E534-4DFB-856F-9D07F38F3A92", "versionEndExcluding": "4.3.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "9BAA2A25-EE70-4B9F-8848-2CCE9C243077", "versionEndExcluding": "4.4.12", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "71845808-53CF-46D1-9A12-F14F1BAED488", "versionEndExcluding": "4.5.5", "versionStartIncluding": "4.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the maximum number of poll options for remote posts, allowing attackers to create polls with a very large amount of options, greatly increasing resource consumption. Depending on the number of poll options, an attacker can cause disproportionate resource usage in both Mastodon servers and clients, potentially causing Denial of Service either server-side or client-side. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched."}, {"lang": "es", "value": "Mastodon es un servidor de red social gratuito y de c\u00f3digo abierto basado en ActivityPub. Las versiones de Mastodon anteriores a la v4.3.18, v4.4.12 y v4.5.5 no tienen un l\u00edmite en el n\u00famero m\u00e1ximo de opciones de encuesta para publicaciones remotas, lo que permite a los atacantes crear encuestas con una cantidad muy grande de opciones, aumentando considerablemente el consumo de recursos. Dependiendo del n\u00famero de opciones de encuesta, un atacante puede causar un uso desproporcionado de recursos tanto en los servidores como en los clientes de Mastodon, lo que podr\u00eda causar una denegaci\u00f3n de servicio ya sea del lado del servidor o del lado del cliente. Las versiones de Mastodon v4.5.5, v4.4.12, v4.3.18 est\u00e1n parcheadas."}], "id": "CVE-2026-23962", "lastModified": "2026-06-17T10:22:21.643", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23962", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T21:34:54.544661Z", "version": "2.0.3"}}]}, "published": "2026-01-22T03:15:46.400", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-gg8q-rcg7-p79g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:28:17.976742+00:00", "value": {"mitigation_remediation": ["Upgrade Mastodon to version v4.3.18 or newer (including v4.4.12 and v4.5.5) and apply all subsequent patches.", "If immediate upgrade is not feasible, restrict or remove the ability for remote posts to include polls with more than a safe threshold of options by configuring the server or applying a custom patch that enforces a hard limit, preventing the excessive resource consumption.", "Monitor server and client logs for unusually large poll posts and temporarily throttle or reject posts that exceed a defined option count, and consider disabling poll functionality for external accounts until a proper limit can be enforced."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected product is the Mastodon social networking platform, maintained by JoinMastodon. Versions of Mastodon prior to v4.3.18, v4.4.12 or v4.5.5 are vulnerable. The issue has been resolved in releases v4.3.18, v4.4.12, and v4.5.5 and any subsequent patches. Administrators running those earlier releases should be aware that any remote post containing a large poll list can trigger this behavior.", "description_and_impact": "Mastodon's lack of limitation on poll options per remote post allows an attacker to craft a single post with an extremely large number of poll options. The processing of such a post leads to a disproportionate consumption of CPU, memory and network resources on both the server and client sides. The resulting exhaustion can bring the server to a halt or cause client applications to freeze, producing a denial of service. This weakness is identified as CWE\u2011770, Excessive Resource Consumption.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity of the vulnerability. The EPSS score of < 1% suggests that the likelihood of exploitation at this time is low, and it is not currently listed in the CISA KEV catalog. Nevertheless, the attack vector is remote and can be performed by any user who can submit a post, since no special credentials or elevated privileges are required. An attacker can therefore freely issue a single oversized poll that will consume resources on all clients that receive the post, potentially leading to service disruption for the entire user base."}}}}, "created": "2026-01-22T10:08:07.965685+00:00", "updated": "2026-04-18T15:30:03.968818+00:00", "vendors": ["joinmastodon", "joinmastodon$PRODUCT$mastodon"]}