CVE-2026-33869 Mastodon has a denial of service for quote authorization

What is CVE-2026-33869?

CVE-2026-33869 is a medium-severity denial of service vulnerability in mastodon, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes.

Weakness: CWE-863

Which versions are affected by CVE-2026-33869?

1 open source package ship an affected version, including mastodon. It affects 1 product.

Products include Joinmastodon Mastodon.

How do I fix CVE-2026-33869?

Upgrade mastodon to a fixed version for your release line: 4.4.15 or 4.5.8.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-33869 being exploited?

There is no known exploitation of CVE-2026-33869 in the wild and no public exploit code.

Other vulnerabilities in mastodon

• CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments Critical 10.0
• CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon Critical 9.8
• CVE-2022-24307 Missing authorization in n/a Critical 9.8
• CVE-2018-21018 Auth bypass in n/a Critical 9.8
• CVE-2024-23832 Mastodon Remote user impersonation and takeover Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-mastodon-2026-33869, GHSA-q4g8-82c5-9h33.