What is the CVSS score of CVE-2026-50129?

CVE-2026-50129 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Mastodon are affected by CVE-2026-50129?

Mastodon self-hosted instances are vulnerable to denial-of-service attacks through malformed content that can crash services or disrupt user access, creating availability risk for organizations using…. A patch is available.

How to fix or mitigate CVE-2026-50129?

Within 24 hours: Inventory all Mastodon instances and determine current versions in use. Within 7 days: Validate upgrade path to patched versions (4.5.11, 4.4.18, or 4.3.24 depending on current version) in staging environment and schedule production deployment. Within 30 days: Deploy patched versions to all self-hosted Mastodon instances in production.

Mastodon CVE-2026-50129

EUVD-2026-39060 HIGH

Uncaught Exception (CWE-248)

2026-06-24 GitHub_M

Information Disclosure Mastodon

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remotely reachable via federation with no auth or interaction and low complexity; impact is availability-only (uncaught-exception crash), so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 22:03 EUVD

Analysis Generated

Jun 24, 2026 - 20:50 vuln.today

DescriptionCVE.org

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception vulerability), due to missing exception handling in the math sanitizer. Malformed <math> nodes can result in a DoS of a whole server or targeted users services, depending on the type of action that includes the malformed nodes and the services interacting with it. This vulnerability is fixed in 4.5.11, 4.4.18, and 4.3.24.

AnalysisAI

Denial of service in Mastodon affects all self-hosted instances prior to 4.5.11, 4.4.18, and 4.3.24, where the math content sanitizer fails to handle exceptions raised while processing malformed <math> nodes (MathML). A remote attacker can craft content containing broken math markup that propagates an uncaught exception, crashing whole-server services or disrupting service for targeted users depending on which component processes the malformed node. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify reachable Mastodon instance

Delivery

Craft malformed <math> MathML node

Exploit

Deliver via federation or post

Execution

Sanitizer raises uncaught exception

Impact

Service crashes, denying availability

Access

Identify reachable Mastodon instance

Delivery

Craft malformed <math> MathML node

Exploit

Deliver via federation or post

Execution

Sanitizer raises uncaught exception

Impact

Service crashes, denying availability

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target run an unpatched Mastodon (below 4.5.11 / 4.4.18 / 4.3.24) and that the malformed `<math>`/MathML content reach a service that invokes the math sanitizer - which occurs through normal federated or user-submitted content paths, so no special non-default feature toggle is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent with a remotely reachable, no-authentication, no-interaction availability attack and accurately reflects the federated, network-exposed nature of Mastodon. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker operating or controlling any federating ActivityPub instance posts or sends content containing a deliberately malformed `<math>` node, then directs it at a victim Mastodon server or a specific user on it. When the victim server's sanitizer processes the node, the uncaught exception crashes the handling service, denying service to the targeted user or the whole instance. …
Remediation	Vendor-released patch: upgrade to Mastodon 4.5.11, 4.4.18, or 4.3.24 (whichever matches your branch) per the advisory at https://github.com/mastodon/mastodon/security/advisories/GHSA-qrgq-9fx2-vf2r. … Detailed patch versions, workarounds, and compensating controls in full report.