CVE-2023-36461CWE-770

Mastodon vulnerable to Denial of Service through slow HTTP responses

High · published July 6, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
70.4
In the wild
Unconfirmed
What it is

Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01308 · 70.4th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2023-07-06T18:57Z
EPSS history
Timeline
  • 06 JUL 18:57Z
    Mastodon vulnerable to Denial of Service through slow HTTP responses
    cvelistv5