Joinmastodon Mastodon
42 CVEs affecting Joinmastodon Mastodon. Latest disclosed: 2026-04-23. Critical: 6, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36460 | Critical | 9.9 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers… |
CVE-2022-2166 | Critical | 9.8 | 2022-11-16 | Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0. |
CVE-2022-24307 | Critical | 9.8 | 2022-02-03 | Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has… |
CVE-2018-21018 | Critical | 9.8 | 2019-09-22 | Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions. |
CVE-2024-23832 | Critical | 9.4 | 2024-02-01 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin… |
CVE-2023-36459 | Critical | 9.3 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker… |
CVE-2024-25623 | High | 8.5 | 2024-02-19 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses… |
CVE-2026-27468 | High | 8.2 | 2026-02-24 | Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 t… |
CVE-2024-37903 | High | 8.2 | 2024-07-05 | Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities… |
CVE-2023-28853 | High | 7.7 | 2023-04-04 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0… |
CVE-2026-41259 | High | 7.5 | 2026-04-23 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up… |
CVE-2026-23962 | High | 7.5 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the ma… |
CVE-2026-22245 | High | 7.5 | 2026-01-08 | Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. M… |
CVE-2023-49952 | High | 7.5 | 2024-11-18 | Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header. |
CVE-2023-36461 | High | 7.5 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read o… |
CVE-2022-46405 | High | 7.5 | 2022-12-04 | Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accoun… |
CVE-2023-42451 | High | 7.4 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances… |
CVE-2026-25540 | Medium | 6.5 | 2026-02-04 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poison… |
CVE-2026-23964 | Medium | 6.5 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in… |
CVE-2026-22246 | Medium | 6.5 | 2026-01-08 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to in… |