Log in Start free

Vulnerability · Published Jul 6, 2023 · Assigned by GitHub_M

CVE-2023-36461Mastodon vulnerable to Denial of Service through slow HTTP responses

High 7.5

In plain English

A high-severity resource allocation without limits in mastodon from mastodon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.3%top 29.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Affected products (as reported)

VendorProductVersions
mastodon mastodon < 3.5.9>= 4.0.0, < 4.0.5>= 4.1.0, < 4.1.3

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References