Inefficient Algorithmic Complexity in Mastodon - #VU159850
Published: November 6, 2026
Vulnerability identifier: #VU159850
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause a denial of service in Mastodon.
The vulnerability exists due to missing safeguards against pathological JSON-LD inputs to the RDF Dataset Canonicalization algorithm used by Mastodon when verifying Linked Data Signatures. An unauthenticated remote attacker can submit crafted activities that each take up to several minutes to process without requiring victim interaction.
Affected software
Mastodon
Remediation
Install security update from vendor's website.
Mastodon - addressed in versions 4.4.24, 4.5.17, 4.6.7, 4.7.1