CVE-2026-23963 (GCVE-0-2026-23963)

Vulnerability from cvelistv5 – Published: 2026-01-22 01:53 – Updated: 2026-01-22 17:32
VLAI
Title
Mastodon missing length limits on list names, filter names, and filter keywords
Summary
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter keywords, allowing any user to set an arbitrarily long string as the name or keyword. Any local user can abuse the list or filter fields to cause disproportionate storage and computing resource usage. They can additionally cause their own web interface to be unusable, although they must intentionally do this to themselves or unknowingly approve a malicious API client. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version
mastodon mastodon Affected: < 4.3.18
Affected: >= 4.4.0, < 4.4.12
Affected: >= 4.5.0, < 4.5.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23963",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T17:30:37.333794Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-22T17:32:13.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mastodon",
          "vendor": "mastodon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.4.0, \u003c 4.4.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.5.0, \u003c 4.5.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter keywords, allowing any user to set an arbitrarily long string as the name or keyword. Any local user can abuse the list or filter fields to cause disproportionate storage and computing resource usage. They can additionally cause their own web interface to be unusable, although they must intentionally do this to themselves or unknowingly approve a malicious API client. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-22T01:53:49.887Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3"
        },
        {
          "name": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18"
        },
        {
          "name": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12"
        },
        {
          "name": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5"
        }
      ],
      "source": {
        "advisory": "GHSA-6x3w-9g92-gvf3",
        "discovery": "UNKNOWN"
      },
      "title": "Mastodon missing length limits on list names, filter names, and filter keywords"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23963",
    "datePublished": "2026-01-22T01:53:49.887Z",
    "dateReserved": "2026-01-19T14:49:06.313Z",
    "dateUpdated": "2026-01-22T17:32:13.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23963",
      "date": "2026-07-09",
      "epss": "0.00296",
      "percentile": "0.21425"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23963\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-22T03:15:46.550\",\"lastModified\":\"2026-06-17T10:22:21.757\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter keywords, allowing any user to set an arbitrarily long string as the name or keyword. Any local user can abuse the list or filter fields to cause disproportionate storage and computing resource usage. They can additionally cause their own web interface to be unusable, although they must intentionally do this to themselves or unknowingly approve a malicious API client. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched.\"},{\"lang\":\"es\",\"value\":\"Mastodon es un servidor de red social gratuito, de c\u00f3digo abierto, basado en ActivityPub. Antes de las versiones 4.5.5, 4.4.12 y 4.3.18, el servidor no aplica una longitud m\u00e1xima para los nombres de listas o filtros, ni para las palabras clave de filtro, permitiendo a cualquier usuario establecer una cadena arbitrariamente larga como nombre o palabra clave. Cualquier usuario local puede abusar de los campos de lista o filtro para causar un uso desproporcionado de los recursos de almacenamiento y computaci\u00f3n. Adicionalmente, pueden hacer que su propia interfaz web sea inutilizable, aunque deben hacerlo intencionalmente a s\u00ed mismos o aprobar sin saberlo un cliente API malicioso. Las versiones de Mastodon v4.5.5, v4.4.12, v4.3.18 est\u00e1n parcheadas.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"mastodon\",\"product\":\"mastodon\",\"versions\":[{\"version\":\"\u003c 4.3.18\",\"status\":\"affected\"},{\"version\":\"\u003e= 4.4.0, \u003c 4.4.12\",\"status\":\"affected\"},{\"version\":\"\u003e= 4.5.0, \u003c 4.5.5\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-22T17:30:37.333794Z\",\"id\":\"CVE-2026-23963\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.3.18\",\"matchCriteriaId\":\"0ADDA491-E534-4DFB-856F-9D07F38F3A92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.0\",\"versionEndExcluding\":\"4.4.12\",\"matchCriteriaId\":\"9BAA2A25-EE70-4B9F-8848-2CCE9C243077\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5.0\",\"versionEndExcluding\":\"4.5.5\",\"matchCriteriaId\":\"71845808-53CF-46D1-9A12-F14F1BAED488\"}]}]}],\"references\":[{\"url\":\"https://github.com/mastodon/mastodon/releases/tag/v4.3.18\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/mastodon/mastodon/releases/tag/v4.4.12\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/mastodon/mastodon/releases/tag/v4.5.5\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-01-23T06:19:04+00:00",
      "cve": "CVE-2026-23963",
      "id": "CVE-2026-23963",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Mastodon missing length limits on list names, filter names, and filter keywords",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23963.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23963\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-22T17:30:37.333794Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-22T17:32:05.892Z\"}}], \"cna\": {\"title\": \"Mastodon missing length limits on list names, filter names, and filter keywords\", \"source\": {\"advisory\": \"GHSA-6x3w-9g92-gvf3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"mastodon\", \"product\": \"mastodon\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 4.3.18\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.4.0, \u003c 4.4.12\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.5.0, \u003c 4.5.5\"}]}], \"references\": [{\"url\": \"https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3\", \"name\": \"https://github.com/mastodon/mastodon/security/advisories/GHSA-6x3w-9g92-gvf3\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/mastodon/mastodon/releases/tag/v4.3.18\", \"name\": \"https://github.com/mastodon/mastodon/releases/tag/v4.3.18\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/mastodon/mastodon/releases/tag/v4.4.12\", \"name\": \"https://github.com/mastodon/mastodon/releases/tag/v4.4.12\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/mastodon/mastodon/releases/tag/v4.5.5\", \"name\": \"https://github.com/mastodon/mastodon/releases/tag/v4.5.5\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter keywords, allowing any user to set an arbitrarily long string as the name or keyword. Any local user can abuse the list or filter fields to cause disproportionate storage and computing resource usage. They can additionally cause their own web interface to be unusable, although they must intentionally do this to themselves or unknowingly approve a malicious API client. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770: Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-22T01:53:49.887Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23963\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-22T17:32:13.067Z\", \"dateReserved\": \"2026-01-19T14:49:06.313Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-22T01:53:49.887Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.