CVE-2026-23963

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23963", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T14:49:06.313Z", "datePublished": "2026-01-22T01:53:49.887Z", "dateUpdated": "2026-01-22T17:32:13.067Z"}, "containers": {"cna": {"title": "Mastodon missing length limits on list names, filter names, and filter keywords", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5"}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"version": "< 4.3.18", "status": "affected"}, {"version": ">= 4.4.0, < 4.4.12", "status": "affected"}, {"version": ">= 4.5.0, < 4.5.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T01:53:49.887Z"}, "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter keywords, allowing any user to set an arbitrarily long string as the name or keyword. Any local user can abuse the list or filter fields to cause disproportionate storage and computing resource usage. They can additionally cause their own web interface to be unusable, although they must intentionally do this to themselves or unknowingly approve a malicious API client. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched."}], "source": {"advisory": "GHSA-6x3w-9g92-gvf3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T17:30:37.333794Z", "id": "CVE-2026-23963", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T17:32:13.067Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23963", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T17:30:37.333794Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T17:32:05.892Z"}}], "cna": {"title": "Mastodon missing length limits on list names, filter names, and filter keywords", "source": {"advisory": "GHSA-6x3w-9g92-gvf3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"status": "affected", "version": "< 4.3.18"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.12"}, {"status": "affected", "version": ">= 4.5.0, < 4.5.5"}]}], "references": [{"url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3", "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18", "name": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12", "name": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5", "name": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter keywords, allowing any user to set an arbitrarily long string as the name or keyword. Any local user can abuse the list or filter fields to cause disproportionate storage and computing resource usage. They can additionally cause their own web interface to be unusable, although they must intentionally do this to themselves or unknowingly approve a malicious API client. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T01:53:49.887Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23963", "state": "PUBLISHED", "dateUpdated": "2026-01-22T17:32:13.067Z", "dateReserved": "2026-01-19T14:49:06.313Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T01:53:49.887Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mastodon", "vendor": "mastodon", "versions": [{"status": "affected", "version": "< 4.3.18"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.12"}, {"status": "affected", "version": ">= 4.5.0, < 4.5.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ADDA491-E534-4DFB-856F-9D07F38F3A92", "versionEndExcluding": "4.3.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "9BAA2A25-EE70-4B9F-8848-2CCE9C243077", "versionEndExcluding": "4.4.12", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "71845808-53CF-46D1-9A12-F14F1BAED488", "versionEndExcluding": "4.5.5", "versionStartIncluding": "4.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter keywords, allowing any user to set an arbitrarily long string as the name or keyword. Any local user can abuse the list or filter fields to cause disproportionate storage and computing resource usage. They can additionally cause their own web interface to be unusable, although they must intentionally do this to themselves or unknowingly approve a malicious API client. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched."}, {"lang": "es", "value": "Mastodon es un servidor de red social gratuito, de c\u00f3digo abierto, basado en ActivityPub. Antes de las versiones 4.5.5, 4.4.12 y 4.3.18, el servidor no aplica una longitud m\u00e1xima para los nombres de listas o filtros, ni para las palabras clave de filtro, permitiendo a cualquier usuario establecer una cadena arbitrariamente larga como nombre o palabra clave. Cualquier usuario local puede abusar de los campos de lista o filtro para causar un uso desproporcionado de los recursos de almacenamiento y computaci\u00f3n. Adicionalmente, pueden hacer que su propia interfaz web sea inutilizable, aunque deben hacerlo intencionalmente a s\u00ed mismos o aprobar sin saberlo un cliente API malicioso. Las versiones de Mastodon v4.5.5, v4.4.12, v4.3.18 est\u00e1n parcheadas."}], "id": "CVE-2026-23963", "lastModified": "2026-06-17T10:22:21.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23963", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T17:30:37.333794Z", "version": "2.0.3"}}]}, "published": "2026-01-22T03:15:46.550", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:59:21.764873+00:00", "value": {"mitigation_remediation": ["Upgrade the Mastodon instance to version 4.5.5 or later (or to 4.4.12 / 4.3.18 if those upgrades are not possible).", "If an upgrade cannot be performed immediately, disable or restrict the creation of lists and filters for local users through configuration or by using administrative controls to prevent the use of excessively long names.", "Monitor server storage and CPU usage for unusual growth patterns, and investigate any large filter or list entries that appear after the update."], "summary": {"action": "Update", "impact": "Denial of Service via resource exhaustion"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Mastodon servers running the open\u2011source social network platform. Any installation using versions older than 4.5.5, 4.4.12, or 4.3.18 is impacted. Updating to v4.5.5, v4.4.12, or v4.3.18 patches the flaw.", "description_and_impact": "Mastodon server versions before 4.5.5, 4.4.12, and 4.3.18 lack maximum length enforcement for list names, filter names, and filter keywords. A local user can therefore create entries with arbitrarily long strings, which forces the server to allocate extra storage and requires extra processing time. This can degrade the performance and usability of the web interface, potentially making it unusable for that user. No external attack vector is required; the flaw can be exercised by anyone who has access to the server's local user interface or API.", "risk_and_exploitability": "The CVSS v3 score is 4.3, indicating moderate severity, and the EPSS score is below 1%, implying that the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local user privileges and can be carried out without additional network exposure. Because the impact is limited to resource exhaustion on the affected server, the threat remains largely contained to the individual user's account or to infrastructure suffering from a sudden spike in storage or CPU usage."}}}}, "created": "2026-01-22T10:08:02.996150+00:00", "updated": "2026-04-18T04:00:08.426161+00:00", "vendors": ["joinmastodon", "joinmastodon$PRODUCT$mastodon"]}