LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23963: Mastodon missing length limits on list names, filter names, and filter keywords

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter keywords, allowing any user to set an arbitrarily long string as the name or keyword. Any local user can abuse the list or filter fields to cause disproportionate storage and computing resource usage. They can additionally cause their own web interface to be unusable, although they must intentionally do this to themselves or unknowingly approve a malicious API client. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched.

MediumCVSS 4.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-23963 lets any local Mastodon user create extremely long list names, filter names, or filter keywords. This can waste storage and processing resources on the server. The impact is availability-focused and rated moderate, not a data theft issue. Patched Mastodon versions are 4.5.5, 4.4.12, and 4.3.18.

Executive priority

Schedule a normal but timely maintenance update for Mastodon instances. This is not presented as a breach-enabling issue, but it can create avoidable service degradation and operational cost if left unpatched on user-facing servers.

Technical view

Mastodon before 4.5.5, 4.4.12, and 4.3.18 lacks maximum length enforcement for list names, filter names, and filter keywords. The flaw is CWE-770, allocation of resources without limits. CVSS 3.1 is 4.3: network reachable, low complexity, low privileges required, no user interaction, low availability impact.

Likely exposure

Exposure applies to Mastodon servers running versions below 4.3.18, 4.4.0 through 4.4.11, or 4.5.0 through 4.5.4. An attacker must be a local user or act through an approved malicious API client affecting that user’s account interface.

Exploitation context

Sources do not report active exploitation, and this CVE is not marked in KEV. Abuse requires authenticated local-user capability. Expected impact is disproportionate storage and compute usage, plus potential self-inflicted web interface breakage for the abusing or tricked user.

Researcher notes

The advisory identifies missing length limits in user-controlled Mastodon list and filter fields. Evidence supports availability impact only: no confidentiality or integrity impact in CVSS. Do not assume unauthenticated exploitation or broad compromise from the provided sources.

Mitigation direction

  • Upgrade Mastodon to 4.5.5, 4.4.12, or 4.3.18 as appropriate.
  • Review the GitHub security advisory and release notes before deployment.
  • If immediate upgrade is delayed, monitor abnormal list and filter object sizes.

Validation and detection

  • Inventory Mastodon versions across all instances.
  • Confirm each instance is on 4.5.5, 4.4.12, 4.3.18, or later.
  • Review application data for unusually long list names, filter names, or filter keywords.
  • Check server resource trends for unexplained storage or compute increases.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-770: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-23963 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L2.81.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.3Medium
CVSS 3.1 vector shape for CVE-2026-23963Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
mastodonmastodon< 4.3.18, >= 4.4.0, < 4.4.12, >= 4.5.0, < 4.5.5Listed
Weakness

CWE details

CWE-770

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-770 · source CWE mapping

Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs