CVE-2023-36461

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Allocation of Resources Without Limits or Throttling pada joinmastodon mastodon. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Rincian

Terbit di NVD

6 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6 patch · advisory pihak ketiga
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9 advisory pihak ketiga
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5 advisory pihak ketiga
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3 advisory pihak ketiga
• https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/07/06/7 mailing list