CVE-2025-54879

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-54879
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54879.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-54879
Aliases
Published
2025-08-05T23:39:59.130Z
Modified
2026-04-10T05:29:42.233204Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
Details

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54879.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mastodon/mastodon

Affected ranges

Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
661f3f26b041dd6f1f0ea646e55616f7139bb957
Fixed
ca1c58d5f69aae80fe22ac8ae982ae4ba2bf4165
Database specific 
{
    "versions": [
        {
            "introduced": "3.1.5"
        },
        {
            "fixed": "4.2.24"
        }
    ]
}
Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
ab36c152f9e5f9054798504354365dcaef4e5c43
Fixed
42594f253e64c559ca2462abab0623dddc82f54c
Database specific 
{
    "versions": [
        {
            "introduced": "4.3.0"
        },
        {
            "fixed": "4.3.11"
        }
    ]
}
Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
69e14246b838443985a541e97327494b8d2fdffb
Fixed
5478ef9b32be0c7ac8f86330760485a7531d218a
Database specific 
{
    "versions": [
        {
            "introduced": "4.4.0"
        },
        {
            "fixed": "4.4.3"
        }
    ]
}

Affected versions

v4.*
v4.3.0
v4.3.1
v4.3.10
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7
v4.3.8
v4.3.9
v4.4.0
v4.4.1
v4.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54879.json"

Git / github.com/tootsuite/mastodon

Affected ranges

Type
GIT
Repo
https://github.com/tootsuite/mastodon
Events
Introduced
661f3f26b041dd6f1f0ea646e55616f7139bb957
Fixed
ca1c58d5f69aae80fe22ac8ae982ae4ba2bf4165
Introduced
ab36c152f9e5f9054798504354365dcaef4e5c43
Fixed
42594f253e64c559ca2462abab0623dddc82f54c
Introduced
69e14246b838443985a541e97327494b8d2fdffb
Fixed
5478ef9b32be0c7ac8f86330760485a7531d218a
Database specific 
{
    "versions": [
        {
            "introduced": "3.1.5"
        },
        {
            "fixed": "4.2.24"
        },
        {
            "introduced": "4.3.0"
        },
        {
            "fixed": "4.3.11"
        },
        {
            "introduced": "4.4.0"
        },
        {
            "fixed": "4.4.3"
        }
    ]
}

Affected versions

v4.*
v4.3.0
v4.3.1
v4.3.10
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7
v4.3.8
v4.3.9
v4.4.0
v4.4.1
v4.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54879.json"