CVE-2026-47389

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.5.10 Mastodon versions prior to 4.4.17 Mastodon versions prior to 4.3.23

Description When using Ruby versions older than 3.4, the PrivateAddressCheck.private address? function incorrectly returns false for IPv4-mapped IPv6 addresses that correspond to private IPv4 addresses. This may include loopback, RFC1918 private networks, and link-local space. An attacker controlling DNS for a domain can use an AAAA record with a mapped address to bypass Server-Side Request Forgery (SSRF) protections. This allows outbound HTTP fetches to establish TCP connections to internal IPv4 addresses, such as 127.0.0.1 and cloud-metadata endpoints like 169.254.169.254.

Recommendations Update to version 4.5.10 or newer. Update to version 4.4.17 or newer. Update to version 4.3.23 or newer.