CVE-2026-50129 | Mastodon is a free, open-source social network server based … | CVSS 7.5 HIGH

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception vulerability), due to missing exception handling in the math sanitizer. Malformed <math> nodes can result in a DoS of a whole server or targeted users services, depending on the type of action that includes the malformed nodes and the services interacting with it. This vulnerability is fixed in 4.5.11, 4.4.18, and 4.3.24.

Metadata

CVE ID: CVE-2026-50129
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-03 18:49 UTC
Published: 2026-06-24 19:50 UTC
Last updated: 2026-06-24 19:50 UTC
Primary CWE: CWE-248
CWE-248: Uncaught Exception
Vendor / Product: mastodon / mastodon
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products (1)

Vendor	Product	Platform	Versions
mastodon	mastodon	—	>= 4.5.0-beta.1, < 4.5.11, >= 4.4.0-beta.1, < 4.4.18, < 4.3.24

Weakness (CWE)

CWE	Source	Description
CWE-248	cna	CWE-248: Uncaught Exception

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (1)

https://github.com/mastodon/mastodon/security/advisories/GHSA-qrgq-9fx2-vf2r https://github.com/mastodon/mastodon/security/advisories/GHSA-qrgq-9fx2-vf2r