CVE-2026-23962
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-02-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| joinmastodon | mastodon | to 4.3.18 (exc) |
| joinmastodon | mastodon | From 4.4.0 (inc) to 4.4.12 (exc) |
| joinmastodon | mastodon | From 4.5.0 (inc) to 4.5.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Mastodon allows attackers to create polls with an excessively large number of options in remote posts because versions before v4.3.18, v4.4.12, and v4.5.5 do not limit the maximum number of poll options. This causes a significant increase in resource consumption on both Mastodon servers and clients, potentially leading to Denial of Service (DoS) conditions. [1]
How can this vulnerability impact me? :
The vulnerability can cause disproportionate resource usage on Mastodon servers and clients, which may result in Denial of Service (DoS). This means the service could become unavailable or unresponsive, disrupting normal operations and access for users. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Mastodon server to version v4.3.18, v4.4.12, or v4.5.5 or later, as these versions include patches that limit the maximum number of poll options in remote posts, preventing excessive resource consumption and potential Denial of Service. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability causes a Denial of Service (DoS) by resource exhaustion but does not impact confidentiality or integrity of data. Therefore, it does not directly affect compliance with standards focused on data protection such as GDPR or HIPAA. However, the availability impact could indirectly affect service reliability obligations under some regulations, but no specific compliance impact is detailed. [1]