Mastodon Denial-of-Service Vulnerability via Poll Options

A denial-of-service vulnerability has been identified in Mastodon, a social network server based on ActivityPub. The issue affects versions prior to v4.3.18, v4.4.12, and v4.5.5. The vulnerability arises from the lack of a limit on the maximum number of poll options for remote posts. This oversight allows attackers to create polls with an excessive number of options, significantly increasing resource consumption. Depending on the volume of poll options, this could lead to disproportionate resource usage on both Mastodon servers and clients, causing potential denial-of-service conditions either server-side or client-side.

Impact

Exploitation of this vulnerability can cause severe resource exhaustion on both the server and client sides, leading to denial-of-service conditions.

Remediation

Users can upgrade to Mastodon versions v4.3.18, v4.4.12, or v4.5.5 to address this vulnerability.