CVE-2026-33869mediumCWE-863

CVE-2026-33869: falha de média gravidade em mastodon

Mastodon has a denial of service for quote authorization

Publicada em

Seguir esta CVE+ Monitorar mastodon

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.8epss 0.2%
Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
mastodon · mastodon
CVEs relacionadas — mastodon

No mesmo produto, das mais perigosas para as menos.

CVE-2023-36460CRITICALMastodon vulnerable to arbitrary file creation through media attachmentsEPSS 40.1%CVE-2024-23832CRITICALMastodon Remote user impersonation and takeoverEPSS 2.5%CVE-2023-36461HIGHMastodon vulnerable to Denial of Service through slow HTTP responsesEPSS 1.3%CVE-2023-28853HIGHMastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP databaseEPSS 1.3%CVE-2023-36459CRITICALMastodon vulnerable to Cross-site Scripting through oEmbed preview cardsEPSS 1.2%CVE-2026-72916MEDIUMMastodon: SSRF Protection Bypass via IPv4-compatible IPv6 AddressesEPSS 1.0%