Mastodon vulnerable to Denial of Service through slow HTTP responses
CVE-2023-36461
7.5HIGH
What is CVE-2023-36461?
Mastodon, an open-source social networking server, is susceptible to a vulnerability that allows a malicious server to extend the response time of outgoing HTTP queries indefinitely. Before the release of versions 3.5.9, 4.0.5, and 4.1.3, attackers could exploit this vulnerability using slowloris-type techniques, keeping all Mastodon workers occupied for extended periods. This behavior could lead to server unresponsiveness, significantly affecting platform performance. Users are encouraged to update to the latest versions to mitigate this risk.
Affected Version(s)
mastodon < 3.5.9 < 3.5.9
mastodon >= 4.0.0, < 4.0.5 < 4.0.0, 4.0.5
mastodon >= 4.1.0, < 4.1.3 < 4.1.0, 4.1.3