CVE-2026-50129CWE-248

Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER

High · published June 24, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception vulerability), due to missing exception handling in the math sanitizer. Malformed <math> nodes can result in a DoS of a whole server or targeted users services, depending on the type of action that includes the malformed nodes and the services interacting with it. This vulnerability is fixed in 4.5.11, 4.4.18, and 4.3.24.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-06-24T19:50Z
EPSS history
Timeline
  • 24 JUN 19:50Z
    Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER
    cvelistv5