What is the CVSS score of CVE-2026-50129?

CVE-2026-50129 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Mastodon are affected by CVE-2026-50129?

Mastodon self-hosted instances are vulnerable to denial-of-service attacks through malformed content that can crash services or disrupt user access, creating availability risk for organizations using…. A patch is available.

How to fix or mitigate CVE-2026-50129?

Within 24 hours: Inventory all Mastodon instances and determine current versions in use. Within 7 days: Validate upgrade path to patched versions (4.5.11, 4.4.18, or 4.3.24 depending on current version) in staging environment and schedule production deployment. Within 30 days: Deploy patched versions to all self-hosted Mastodon instances in production.

Mastodon CVE-2026-50129

EUVD-2026-39060 HIGH

Uncaught Exception (CWE-248)

2026-06-24 GitHub_M

Information Disclosure Mastodon

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remotely reachable via federation with no auth or interaction and low complexity; impact is availability-only (uncaught-exception crash), so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 22:03 EUVD

Analysis Generated

Jun 24, 2026 - 20:50 vuln.today

DescriptionCVE.org

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception vulerability), due to missing exception handling in the math sanitizer. Malformed <math> nodes can result in a DoS of a whole server or targeted users services, depending on the type of action that includes the malformed nodes and the services interacting with it. This vulnerability is fixed in 4.5.11, 4.4.18, and 4.3.24.

AnalysisAI

Denial of service in Mastodon affects all self-hosted instances prior to 4.5.11, 4.4.18, and 4.3.24, where the math content sanitizer fails to handle exceptions raised while processing malformed <math> nodes (MathML). A remote attacker can craft content containing broken math markup that propagates an uncaught exception, crashing whole-server services or disrupting service for targeted users depending on which component processes the malformed node. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; CVSS is 7.5 with availability-only impact.

Technical ContextAI

Mastodon is a Ruby on Rails ActivityPub federated microblogging server that sanitizes inbound HTML/MathML before storing and rendering it. The root cause is CWE-248 (Uncaught Exception): the math sanitizer routine lacks exception handling, so a malformed <math> element triggers an error that is not rescued and propagates up the stack, aborting the request or background job that touches the content. Because Mastodon federates content over ActivityPub, malformed nodes can arrive from remote instances and be processed by multiple services (web rendering, streaming, background Sidekiq workers, federation handlers), which is why the advisory notes impact ranges from a single targeted user's services to the entire server. The affected CPE is cpe:2.3:a:mastodon:mastodon for all versions below the fixed releases.

RemediationAI

Vendor-released patch: upgrade to Mastodon 4.5.11, 4.4.18, or 4.3.24 (whichever matches your branch) per the advisory at https://github.com/mastodon/mastodon/security/advisories/GHSA-qrgq-9fx2-vf2r. Upgrading is the primary and recommended fix because the flaw is in core sanitization logic. If an immediate upgrade is not possible, compensating controls are limited given Mastodon must process federated content: operators can defederate from or limit untrusted/unknown instances to reduce the inbound surface for malformed <math> nodes (trade-off: loses federation reach with those servers), and can place rate limiting and process supervision (e.g., systemd auto-restart of Puma/Sidekiq workers) in front of services so a crashed worker recovers quickly (trade-off: mitigates symptoms, not the underlying exception, and repeated crashes can still degrade service). Monitor Sidekiq and web/streaming error logs for unhandled exceptions involving math/MathML parsing as a detection signal.