Resource exhaustion in Mastodon - #VU159852
Published: November 6, 2026
Vulnerability identifier: #VU159852
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service in Mastodon by consuming processing resources with crafted activities.
The vulnerability exists due to Mastodon's JSON-LD processing performing an expensive operation on activity graphs before checking whether those graphs are too large. An unauthenticated remote attacker can submit crafted activities that each take up to several seconds to process without requiring victim interaction.
Affected software
Mastodon
Remediation
Install security update from vendor's website.
Mastodon - update to 4.7.5