CVE-2022-46405

Published: Dec 4, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.

Affected (1)

Products: Joinmastodon: Mastodon

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Joinmastodon Mastodon	Up to 4.0.2

Related CWEs

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (4)

https://borg.social/notes/98bcoo2t1n

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://hackmd.io/rD9nsTz1QeuPT-erxqjY-A

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://borg.social/notes/98bcoo2t1n

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://hackmd.io/rD9nsTz1QeuPT-erxqjY-A

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.