CVE-2023-36461 Mastodon vulnerable to Denial of Service through slow HTTP responses

What is CVE-2023-36461?

CVE-2023-36461 is a high-severity denial of service vulnerability in mastodon, published on 6 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Weakness: CWE-770

Which versions are affected by CVE-2023-36461?

1 open source package ship an affected version, including mastodon. It affects 1 product.

Products include Joinmastodon Mastodon.

How do I fix CVE-2023-36461?

Upgrade mastodon to a fixed version for your release line: 3.5.9, 4.0.5 or 4.1.3.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-36461 being exploited?

There is no known exploitation of CVE-2023-36461 in the wild and no public exploit code.

Other vulnerabilities in mastodon

• CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments Critical 10.0
• CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon Critical 9.8
• CVE-2022-24307 Missing authorization in n/a Critical 9.8
• CVE-2018-21018 Auth bypass in n/a Critical 9.8
• CVE-2024-23832 Mastodon Remote user impersonation and takeover Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-mastodon-2023-36461, GHSA-9pxv-6qvf-pjwc.