CVE Explorer
CVE-2026-23963
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter keywords, allowing any user to set an arbitrarily long string as the name or keyword. Any local user can abuse the list or filter fields to cause disproportionate storage and computing resource usage. They can additionally cause their own web interface to be unusable, although they mu
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"mastodon","vendor":"mastodon","versions":[{"status":"affected","version":"< 4.3.18"},{"status":"affected","version":">= 4.4.0, < 4.4.12"},{"status":"affected","version":">= 4.5.0, < 4.5.5"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:f16319d2d6746a7ef7eb5b143edcb29d536f0c77221c9e3627410bd549af1baf · sha256:fd0956843b21927e… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:f16319d2d6746a7ef7eb5b143edcb29d536f0c77221c9e3627410bd549af1baf · sha256:fd0956843b21927e… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-770","description":"CWE-770: Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:f16319d2d6746a7ef7eb5b143edcb29d536f0c77221c9e3627410bd549af1baf · sha256:fd0956843b21927e… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/mastodon/mastodon/releases/tag/v4.3.18","tags":["x_refsource_MISC"],"url":"https://github.com/mastodon/mastodon/releases/tag/v4.3.18"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:f16319d2d6746a7ef7eb5b143edcb29d536f0c77221c9e3627410bd549af1baf · sha256:fd0956843b21927e… · /containers/cna/references/1
{"name":"https://github.com/mastodon/mastodon/releases/tag/v4.4.12","tags":["x_refsource_MISC"],"url":"https://github.com/mastodon/mastodon/releases/tag/v4.4.12"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:f16319d2d6746a7ef7eb5b143edcb29d536f0c77221c9e3627410bd549af1baf · sha256:fd0956843b21927e… · /containers/cna/references/2
{"name":"https://github.com/mastodon/mastodon/releases/tag/v4.5.5","tags":["x_refsource_MISC"],"url":"https://github.com/mastodon/mastodon/releases/tag/v4.5.5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:f16319d2d6746a7ef7eb5b143edcb29d536f0c77221c9e3627410bd549af1baf · sha256:fd0956843b21927e… · /containers/cna/references/3
{"name":"https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3","tags":["x_refsource_CONFIRM"],"url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:f16319d2d6746a7ef7eb5b143edcb29d536f0c77221c9e3627410bd549af1baf · sha256:fd0956843b21927e… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.