CVE-2023-28853

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform LDAP injection...

CVE-2023-42451

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc...

CVE-2023-42450

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

CVE-2023-36459

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview...

CVE-2023-36461

Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through...

CVE-2023-36462

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a...

CVE-2023-49952

Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header...

CVE-2023-42452

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to...

CVE-2022-48364

The undomarkstatusesassensitive method in app/services/approveappealservice.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive...

CVE-2022-46405

Mastodon through 4.0.2 allows attackers to cause a denial of service large Sidekiq pull queue by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated message...

CVE-2022-24307

Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. JSON-LD signing has been supported since version 1.6.0...

CVE-2025-4575

creationtimestamp| type| source ---|---|--- 2025-05-22 13:43:14+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17265 2025-05-22 14:25:05+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114551940998291137 2025-05-22 15:28:56+00:00| seen|...

CVE-2018-21018

Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions...

BIT-MASTODON-2023-49952

Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header...

BIT-MASTODON-2024-34535

In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header...

CVE-2025-1305

creationtimestamp| type| source ---|---|--- 2025-05-01 05:48:31+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114431001227819569 2025-05-01 05:56:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo3msl2aeo2r 2025-05-01 07:01:28+00:00| seen|...

CVE-2025-2816

creationtimestamp| type| source ---|---|--- 2025-05-01 03:13:59+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14215 2025-05-01 03:48:38+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114430529833344469 2025-05-01 05:55:17+00:00| seen|...

CVE-2025-46558

creationtimestamp| type| source ---|---|--- 2025-04-30 19:13:38+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14127 2025-04-30 19:48:40+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114428642542388304 2025-04-30 20:30:48+00:00| seen|...

CVE-2025-21416

creationtimestamp| type| source ---|---|--- 2025-04-30 17:21:47+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114428064949898924 2025-04-30 17:36:04+00:00| seen| https://bsky.app/profile/cti-news.bsky.social/post/3lo2dgyrzrv2l 2025-04-30 19:48:32+00:00| seen|...

CVE-2025-30390

creationtimestamp| type| source ---|---|--- 2025-04-30 17:21:46+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114428064949898924 2025-04-30 19:48:34+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114428642039876617 2025-04-30 20:30:47+00:00| seen|...