CVE-2026-72914

Received Received - Intake

Resource Exhaustion in Mastodon via Admin API

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72914

Affected Vendors & Products

Vendor	Product	Version / Range
mastodon	mastodon	4.4.21
mastodon	mastodon	4.5.14
mastodon	mastodon	4.6.4
mastodon	mastodon	4.7.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-405	The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Attack-Flow Graph

Executive Summary

This vulnerability in Mastodon versions before 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 involves administrative statistics endpoints that performed expensive SQL calculations before checking authorization. Anonymous users could submit parameters triggering long-running queries, consuming server resources and potentially causing denial of service.

Detection Guidance

Check Mastodon server version with 'mastodon --version' or inspect Gemfile.lock for version numbers. Monitor for unusual SQL query loads or high CPU usage from anonymous requests to /api/v1/admin/measures or /api/v1/admin/retention endpoints.

Impact Analysis

This vulnerability could allow attackers to overload your Mastodon server by repeatedly sending requests that trigger resource-intensive database queries. This may lead to degraded performance, crashes, or unavailability of the service for legitimate users.

Mitigation Strategies

Upgrade Mastodon to versions 4.4.21, 4.5.14, 4.6.4, or 4.7.0-beta.1 or later. Temporarily restrict access to admin statistics endpoints via firewall rules until upgrade is completed.

Hi! I’m here to help you understand CVE-2026-72914. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70