A resource consumption vulnerability in the Mastodon social network server allows unauthenticated attackers to cause a denial of service through amplification.

This is a denial of service vulnerability involving asymmetric resource consumption (CWE-405) and lack of resource throttling (CWE-770). It allows an unauthenticated remote attacker to exhaust server resources by sending specifically crafted requests.

Successful exploitation can lead to significant service degradation or total system unavailability, impacting the availability of the Mastodon instance. Given the CVSS score of 7.5, this represents a high risk for administrators who must maintain uptime for their users, as the vulnerability can be leveraged to disrupt operations via network-based attacks.

Immediate Action: Update Mastodon instances to versions 4.4.21, 4.5.14, or 4.6.4, depending on the currently installed release branch.

Proactive Monitoring: Monitor server CPU and memory usage for sudden spikes that do not correlate with legitimate user traffic, which may indicate an ongoing denial of service attempt.

Compensating Controls: Deploy a Web Application Firewall or rate-limiting proxy in front of the Mastodon server to filter out malicious traffic patterns.

Public Exploit Available: Unknown.

Administrators should apply the provided patches immediately to prevent potential denial of service attacks. Ensuring the software is updated to the latest secure version is critical for maintaining the stability and availability of the Mastodon platform.