VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Mar 27, 2026· Updated Jun 17, 2026

CVE-2026-33869

CVE-2026-33869

Description

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Mastodon/Mastodon3 versions
    cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*range: >=4.4.0,<4.4.15
    • (no CPE)range: <4.5.8, <4.4.15
    • (no CPE)range: >= 4.5.0, < 4.5.8
  • osv-coords
    pkg:bitnami/mastodon
    Range: >= 4.4.0, < 4.4.15

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.