High · published January 22, 2026
⚡ No cap on poll options? That's a recipe for disaster! Mastodon versions prior to v4.3.18, v4.4.12, and v4.5.5 let attackers create polls with an overwhelming number of choices — think of it as a buffet with an endless menu! Imagine walking into a restaurant where the waiter hands you a menu that never ends — the sheer volume of options could overwhelm your dining experience and leave the kitchen in chaos. This vulnerability allows for a similar scenario on Mastodon, where limitless poll options can choke the server's resources. An attacker can unleash a flood of resource-hogging polls, causing both the server and clients to grind to a halt. This could lead to Denial of Service, making it impossible for users to enjoy their social networking experience — a total communication shutdown!
Imagine walking into a restaurant where the waiter hands you a menu that never ends — the sheer volume of options could overwhelm your dining experience and leave the kitchen in chaos. This vulnerability allows for a similar scenario on Mastodon, where limitless poll options can choke the server's resources. This flaw arises because Mastodon doesn't limit the number of poll options for remote posts, allowing malicious users to create excessively large polls that consume system resources, potentially leading to a service denial.
An attacker can unleash a flood of resource-hogging polls, causing both the server and clients to grind to a halt. This could lead to Denial of Service, making it impossible for users to enjoy their social networking experience — a total communication shutdown! Immediately upgrade to Mastodon versions v4.5.5, v4.4.12, or v4.3.18 to close this vulnerability. Additionally, consider implementing rate limits or custom validation for poll options in your own Mastodon applications to prevent future exploits. You've got this! With these fixes, your Mastodon server will be back to its robust self in no time! 🛡️