BIT-mastodon-2023-36461

    Dashboard / Vulnerabilities / BIT-mastodon-2023-36461

    BIT-mastodon-2023-36461

    Published: 6 Mar 2024Last Modified: 8 Sept 2026

    Summary: Mastodon vulnerable to Denial of Service through slow HTTP responses

    Details: Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

    References: http://www.openwall.com/lists/oss-security/2023/07/06/7, https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6, https://github.com/mastodon/mastodon/releases/tag/v3.5.9, https://github.com/mastodon/mastodon/releases/tag/v4.0.5, https://github.com/mastodon/mastodon/releases/tag/v4.1.3, https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc, https://nvd.nist.gov/vuln/detail/CVE-2023-36461

    Affected packages

    Package

    Name: mastodon

    Purl: pkg:bitnami/mastodon

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -3.5.9

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-mastodon-2023-36461 | CVE-DB