CVE-2025-54879
Description
Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.
How to fix
- joinmastodon mastodon4.2.24, 4.3.11, 4.4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| joinmastodon mastodon | 3.1.5 ≤ v < 4.2.24, 4.3.0 ≤ v < 4.3.11, 4.4.0 ≤ v < 4.4.3 | 4.2.24, 4.3.11, 4.4.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.