Log in Start free

Vulnerability · Published Jan 22, 2026 · Assigned by GitHub_M

CVE-2026-23962Mastodon vulnerable to Denial of Service from a single post (client/server)

High 7.5

In plain English

A high-severity resource allocation without limits in mastodon from mastodon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 54.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the maximum number of poll options for remote posts, allowing attackers to create polls with a very large amount of options, greatly increasing resource consumption. Depending on the number of poll options, an attacker can cause disproportionate resource usage in both Mastodon servers and clients, potentially causing Denial of Service either server-side or client-side. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched.

Affected products (as reported)

VendorProductVersions
mastodon mastodon < 4.3.18>= 4.4.0, < 4.4.12>= 4.5.0, < 4.5.5

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References