CVE-2023-36461

    Dashboard / Vulnerabilities / CVE-2023-36461

    CVE-2023-36461

    Published: 6 Jul 2023Last Modified: 12 Aug 2026

    Summary: Mastodon vulnerable to Denial of Service through slow HTTP responses

    Details: Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

    References: http://www.openwall.com/lists/oss-security/2023/07/06/7, https://github.com/mastodon/mastodon/releases/tag/v3.5.9, https://github.com/mastodon/mastodon/releases/tag/v4.0.5, https://github.com/mastodon/mastodon/releases/tag/v4.1.3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36461.json, https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc, https://nvd.nist.gov/vuln/detail/CVE-2023-36461, https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -b10c974ba1952c545acff505bfd36feb0c60b000

    Affected versions

    v3.5.8
    v3.5.7
    v3.5.6
    v3.5.5
    v3.5.4
    v3.5.3
    v3.5.2
    v3.5.1
    v3.5.0
    v3.5.0rc3
    v3.5.0rc2
    v3.5.0rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-36461 | CVE-DB