CVE-2026-23962
📋 TL;DR
Mastodon servers running vulnerable versions allow attackers to create remote posts with unlimited poll options, causing excessive resource consumption. This can lead to denial of service on both servers and clients. All Mastodon instances before patched versions are affected.
💻 Affected Systems
- Mastodon
📦 What is this software?
Mastodon by Joinmastodon
Mastodon by Joinmastodon
Mastodon by Joinmastodon
⚠️ Risk & Real-World Impact
Worst Case
Complete server unavailability due to resource exhaustion, affecting all users and potentially causing cascading failures in federated networks.
Likely Case
Degraded server performance, increased response times, and potential service interruptions during attack periods.
If Mitigated
Minimal impact with proper rate limiting and monitoring in place, though still vulnerable to targeted attacks.
🎯 Exploit Status
Attack requires creating or interacting with remote posts containing polls with excessive options.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.5.5, v4.4.12, or v4.3.18
Vendor Advisory: https://github.com/mastodon/mastodon/security/advisories/GHSA-gg8q-rcg7-p79g
Restart Required: Yes
Instructions:
1. Backup your Mastodon instance. 2. Update to v4.5.5, v4.4.12, or v4.3.18 using your package manager or git. 3. Run bundle install and yarn install. 4. Run database migrations. 5. Restart Mastodon services.
🔧 Temporary Workarounds
Rate limit poll creation
allImplement application-level rate limiting for poll creation endpoints
Configure rate limiting in nginx/apache or application firewall
Block suspicious remote instances
allTemporarily block instances sending posts with excessive poll options
Use Mastodon admin interface to block domains
🧯 If You Can't Patch
- Implement strict rate limiting on poll creation endpoints
- Monitor for unusual poll activity and block offending instances
🔍 How to Verify
Check if Vulnerable:
Check Mastodon version against affected versionsCheck Version:
grep VERSION /opt/mastodon/.env.production or check admin interfaceVerify Fix Applied:
Confirm version is v4.5.5, v4.4.12, or v4.3.18 or later📡 Detection & Monitoring
Log Indicators:
- Unusually large poll creation requests
- Spike in memory/CPU usage
- Timeout errors on poll endpoints
Network Indicators:
- High volume of POST requests to poll endpoints
- Large payloads to /api/v1/polls
SIEM Query:
source="mastodon.logs" AND ("poll" AND "options") | stats count by src_ip