Fiche vulnérabilité
CVE-2023-36461 : faille élevée joinmastodon mastodon (CVSS 7.5)
Description
Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.
En bref
- Sévérité
- Élevée (CVSS 7.5)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Exploitation active
- Non signalée par la CISA
- Publication
- 6 juil. 2023
- Dernière mise à jour
- 17 juin 2026
Produits concernés
- joinmastodon mastodon
Références
- Fiche CVE-2023-36461 sur le NVD (NIST)
- openwall.com/lists/oss-security/2023/07/06/7
- github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b…
- github.com/mastodon/mastodon/releases/tag/v3.5.9
- github.com/mastodon/mastodon/releases/tag/v4.0.5
- github.com/mastodon/mastodon/releases/tag/v4.1.3
- github.com/mastodon/mastodon/security/advisories/GHSA…