Executive brief
Mastodon is an open-source social networking platform. A vulnerability in how the server processes mathematical formulas allows an attacker to crash the service by sending specially crafted content. This can result in a total service outage for the entire server or targeted disruptions for specific users and their followers.
Technical details
A Denial of Service (DoS) vulnerability exists in Mastodon due to an uncaught 'NoMethodError' exception within the 'MATH_TRANSFORMER' component. The root cause is missing exception handling in the math sanitizer when processing malformed <math> nodes. An unauthenticated remote attacker can exploit this by posting or sending forged content containing these nodes. Depending on where the content is viewed, this can crash the rendering of timelines, RSS feeds, or specific user profiles, effectively disabling access to those services. The issue is resolved in versions 4.5.11, 4.4.18, and 4.3.24.
Affected products
- Mastodon Mastodon < 4.3.24, 4.4.0-beta.1 to < 4.4.18, 4.5.0-beta.1 to < 4.5.11
Timeline
- 2026-06-03: advisory: GitHub security advisory published
- 2026-06-24: disclosed: CVE published to NVD