CVE-2023-36461

Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

• CWE-770

• http://www.openwall.com/lists/oss-security/2023/07/06/7Mailing List
• https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6Patch, Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
• https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwcThird Party Advisory
• http://www.openwall.com/lists/oss-security/2023/07/06/7Mailing List
• https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6Patch, Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
• https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwcThird Party Advisory

Published

Jul 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36456authentik is an open-source Identity Provider. Prior to vers…7.3
• CVE-2023-364571Panel is an open source Linux server operation and maintena…8.8
• CVE-2023-364581Panel is an open source Linux server operation and maintena…8.8
• CVE-2023-36459Mastodon is a free, open-source social network server based …6.1
• CVE-2023-3646On affected platforms running Arista EOS with mirroring to m…7.5
• CVE-2023-36460Mastodon is a free, open-source social network server based …9.9
• CVE-2023-36462Mastodon is a free, open-source social network server based …5.4
• CVE-2023-36463Meldekarten generator is an open source project to create a …6.1
• CVE-2023-36464pypdf is an open source, pure-python PDF library. In affecte…5.5
• CVE-2023-36465Decidim is a participatory democracy framework, written in R…7.1
• CVE-2023-36466Discourse is an open source discussion platform. When editin…4.3
• CVE-2023-36467AWS data.all is an open source development framework to help…8.8