An unauthenticated attacker can trigger a denial of service on Mastodon servers and clients by crafting remote posts with an excessive number of poll options.

This vulnerability is an allocation of resources without limits (CWE-770) occurring within the poll creation functionality. An unauthenticated attacker can exploit this by submitting remote posts containing an unlimited number of options, forcing the system to consume disproportionate memory and CPU resources.

The exploitation of this flaw can result in significant service degradation or complete system downtime for Mastodon instances. Given the CVSS score of 7.5, this high severity vulnerability poses a direct risk to service availability, which may lead to reputational damage and the loss of user trust in the platform's reliability.

Immediate Action: Upgrade to Mastodon versions 4.3.18, 4.4.12, or 4.5.5, which introduce the necessary limits on poll options to prevent resource exhaustion.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory spikes associated with incoming remote post processing or ActivityPub traffic.

Compensating Controls: Implement rate limiting on incoming ActivityPub requests at the network or reverse proxy layer to mitigate the impact of malicious, high-volume payloads until patching is complete.

Public Exploit Available: No

Administrators of Mastodon instances should prioritize the transition to the patched versions immediately. Because this vulnerability allows for unauthenticated resource exhaustion, it is a significant risk to platform stability and should be addressed as part of the next scheduled maintenance window, or sooner if the instance is exposed to high volumes of untrusted remote traffic.