High severity7.5NVD Advisory· Published Jul 6, 2023· Updated Jun 17, 2026
CVE-2023-36461
CVE-2023-36461
Description
Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4Patches
Vulnerability mechanics
References
6- github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6nvdPatchThird Party Advisory
- github.com/mastodon/mastodon/releases/tag/v3.5.9nvdThird Party Advisory
- github.com/mastodon/mastodon/releases/tag/v4.0.5nvdThird Party Advisory
- github.com/mastodon/mastodon/releases/tag/v4.1.3nvdThird Party Advisory
- github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwcnvdThird Party Advisory
- www.openwall.com/lists/oss-security/2023/07/06/7nvdMailing List
News mentions
0No linked articles in our index yet.