CVE-2026-50129

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50129
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50129.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50129
Aliases
Published
2026-06-24T19:50:51.968Z
Modified
2026-07-15T01:49:13.364622001Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER
Details

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception vulerability), due to missing exception handling in the math sanitizer. Malformed <math> nodes can result in a DoS of a whole server or targeted users services, depending on the type of action that includes the malformed nodes and the services interacting with it. This vulnerability is fixed in 4.5.11, 4.4.18, and 4.3.24.

Database specific 
{
    "cwe_ids": [
        "CWE-248"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50129.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "4.3.24"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mastodon/mastodon

Affected ranges

Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
5a8ab0a3e62a8825e28bb74c1760ba6488d20c97
Fixed
0748a5ff81b24e666ab10b8ee7fbc6f0362c8cb0
Introduced
12c0e58d9aa80db570fba5fa5146f3a640e99b42
Fixed
3555d595e2a6fcf425c73f783e8709b1e44c0872
Database specific 
{
    "extracted_events": [
        {
            "introduced": "4.5.0-beta.1"
        },
        {
            "fixed": "4.5.11"
        },
        {
            "introduced": "4.4.0-beta.1"
        },
        {
            "fixed": "4.4.18"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v4.*
v4.4.0
v4.4.0-beta.1
v4.4.0-beta.2
v4.4.0-rc.1
v4.4.1
v4.4.10
v4.4.11
v4.4.12
v4.4.13
v4.4.14
v4.4.15
v4.4.16
v4.4.17
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.4.8
v4.4.9
v4.5.0
v4.5.0-beta.1
v4.5.0-beta.2
v4.5.0-rc.1
v4.5.0-rc.2
v4.5.0-rc.3
v4.5.1
v4.5.10
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.5.6
v4.5.7
v4.5.8
v4.5.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50129.json"