CVE-2026-33869

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33869", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T15:10:05.678Z", "datePublished": "2026-03-27T19:52:21.166Z", "dateUpdated": "2026-03-27T20:29:18.521Z"}, "containers": {"cna": {"title": "Mastodon has a denial of service for quote authorization", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-q4g8-82c5-9h33", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-q4g8-82c5-9h33"}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"version": ">= 4.5.0, < 4.5.8", "status": "affected"}, {"version": ">= 4.4.0, < 4.4.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T19:52:21.166Z"}, "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes."}], "source": {"advisory": "GHSA-q4g8-82c5-9h33", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-27T20:29:10.346345Z", "id": "CVE-2026-33869", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T20:29:18.521Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33869", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T20:29:10.346345Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T20:29:14.109Z"}}], "cna": {"title": "Mastodon has a denial of service for quote authorization", "source": {"advisory": "GHSA-q4g8-82c5-9h33", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"status": "affected", "version": ">= 4.5.0, < 4.5.8"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.15"}]}], "references": [{"url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-q4g8-82c5-9h33", "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-q4g8-82c5-9h33", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T19:52:21.166Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33869", "state": "PUBLISHED", "dateUpdated": "2026-03-27T20:29:18.521Z", "dateReserved": "2026-03-24T15:10:05.678Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-27T19:52:21.166Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mastodon", "vendor": "mastodon", "versions": [{"status": "affected", "version": ">= 4.5.0, < 4.5.8"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.15"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "A37B2AD4-5027-464B-947A-63BDB06C33B8", "versionEndExcluding": "4.4.15", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE32DA85-D71D-4CB8-8216-205780DBBB6A", "versionEndExcluding": "4.5.8", "versionStartIncluding": "4.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes."}], "id": "CVE-2026-33869", "lastModified": "2026-06-17T10:38:14.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33869", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-27T20:29:10.346345Z", "version": "2.0.3"}}]}, "published": "2026-03-27T20:16:34.500", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-q4g8-82c5-9h33"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.5.0,4.5.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,4.4.15)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "mastodon", "source": "cna", "vendor": "mastodon"}, "product": "mastodon", "vendor": "joinmastodon"}], "analysis": {"en": {"generated_at": "2026-03-30T20:39:21.015660+00:00", "value": {"mitigation_remediation": ["Deploy the latest patched version of Mastodon (4.5.8 or 4.4.15).", "Verify that the instance version is no longer vulnerable.", "If upgrading is not immediately possible, monitor for quote\u2011related errors and log unusual activity."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Mastodon\u2019s community servers running the 4.5.x branch older than version 4.5.8, or the 4.4.x branch older than 4.4.15, are vulnerable. Earlier releases, such as 4.3 and back, do not include quote functionality and therefore are not affected. Anyone operating a Mastodon instance that has not applied the latest patch should consider the risk of a service interruption related to quote processing.", "description_and_impact": "Mastodon versions before 4.5.8 on the 4.5.x branch and before 4.4.15 on the 4.4.x branch contain a flaw that lets an attacker, who has knowledge of a pending quote, cause the server to reject or mishandle that quote. The result is that the quote cannot be posted, resulting in an interruption of service for the impacted user or the public timeline. The weakness corresponds to CWE-863, which relates to missing or improper handling of a request, and is manifested as a denial of service.", "risk_and_exploitability": "The vulnerability has a CVSS score of 4.8, indicating a moderate impact. Its EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The likely attack vector involves the attacker knowing a quote before it reaches the server, then crafting a request to deceive the server into rejecting that quote; this inference comes from the description. Because the flaw only affects quote processing and not broader system functions, the scope is limited to the affected features."}}}}, "created": "2026-03-29T20:30:19.991046+00:00", "updated": "2026-03-30T20:57:02.388520+00:00", "vendors": ["joinmastodon", "joinmastodon$PRODUCT$mastodon"]}