CVE-2026-33869

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33869
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33869.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33869
Aliases
Published
2026-03-27T19:52:21.166Z
Modified
2026-04-02T13:41:01.657554Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Mastodon has a denial of service for quote authorization
Details

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33869.json"
}
References

Affected packages

Git / github.com/mastodon/mastodon

Affected ranges

Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
26c78392f88afccebb8a88b68bc9994a9ce12648
Fixed
38e7bb9b866b5d207a511de093de25536f13e9c4
Database specific 
{
    "versions": [
        {
            "introduced": "4.5.0"
        },
        {
            "fixed": "4.5.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
69e14246b838443985a541e97327494b8d2fdffb
Fixed
7c28ff90fcb7be07f8fec76f5cdbf4e094917f70
Database specific 
{
    "versions": [
        {
            "introduced": "4.4.0"
        },
        {
            "fixed": "4.4.15"
        }
    ]
}

Affected versions

v4.*
v4.4.0
v4.4.1
v4.4.10
v4.4.11
v4.4.12
v4.4.13
v4.4.14
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.4.8
v4.4.9
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.5.6
v4.5.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33869.json"