CVE-2023-36461

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 3.5.9 Mastodon versions prior to 4.0.5 Mastodon versions prior to 4.1.3

Description The issue is related to Mastodon's handling of outgoing HTTP queries, where a timeout is set on individual read operations. A malicious server can extend the response duration indefinitely through slowloris-type attacks, keeping all Mastodon workers busy and leading to the server becoming unresponsive.

Recommendations For versions prior to 3.5.9, update to version 3.5.9 or later. For versions prior to 4.0.5, update to version 4.0.5 or later. For versions prior to 4.1.3, update to version 4.1.3 or later.