CVE-2026-23962: 
NixOS vulnerability analysis and mitigation

CVE-2026-23962 is a Denial of Service vulnerability in Mastodon, the open-source ActivityPub-based social network server, caused by the absence of a limit on the maximum number of poll options for remote posts. An unauthenticated remote attacker can craft a federated post containing an excessive number of poll options, causing disproportionate resource consumption on both Mastodon servers and clients. The vulnerability affects all Mastodon versions before v4.3.18, v4.4.12, and v4.5.5. It was published on January 22, 2026, with patches released on January 20, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): Mastodon does not enforce any upper bound on the number of poll options when processing incoming federated (remote) posts via the ActivityPub protocol. An attacker operating a malicious or compromised ActivityPub server can craft and federate a poll post with an arbitrarily large number of options. When a vulnerable Mastodon instance receives and processes this post — or when a client renders it — the unbounded data causes excessive memory, CPU, or rendering resource consumption. No authentication, privileges, or user interaction are required, as the attack is delivered through the federated network layer (GitHub Advisory).

Successful exploitation can cause Denial of Service conditions on both the server side (Mastodon instance) and the client side (users' browsers or apps rendering the malicious post). The attack requires no authentication and can be triggered remotely over the network, making it accessible to any actor capable of operating or compromising an ActivityPub-compatible server. There is no confidentiality or integrity impact; the sole consequence is high availability impact, potentially disrupting service for all users of an affected Mastodon instance (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it straightforward to exploit for any actor with access to a federated ActivityPub server. The EPSS score is approximately 0.041%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Set up a malicious ActivityPub server: The attacker operates or controls an ActivityPub-compatible server (e.g., a custom or modified Mastodon instance) that is capable of federating with target Mastodon instances.
2. Craft a malicious poll post: Create an ActivityPub Note or Question object with an abnormally large number of anyOf or oneOf poll option entries — far exceeding what a legitimate client would generate.
3. Federate the post to the target: Publish the crafted post from the attacker-controlled server so that it is delivered to one or more target Mastodon instances via the ActivityPub federation protocol (HTTP POST to the target's inbox endpoint).
4. Trigger resource exhaustion: The target Mastodon server processes the incoming activity without enforcing a limit on poll options, causing excessive resource consumption (CPU, memory, database writes) during ingestion and rendering.
5. Achieve DoS: Depending on the scale of the poll options and the server's capacity, the target instance may become unresponsive or crash, and clients rendering the post may also experience freezing or crashes (GitHub Advisory).

• Network: Incoming ActivityPub federation requests (HTTP POST to /inbox or user inbox endpoints) containing unusually large JSON payloads with a high number of poll option entries (anyOf/oneOf arrays).
• Logs: Mastodon application logs showing spikes in processing time or errors when handling incoming federated activities from a specific remote server; repeated large ActivityPub payloads from the same origin domain.
• Process/System: Sudden spikes in CPU or memory usage on Mastodon worker processes (Sidekiq) coinciding with federation activity; potential OOM (out-of-memory) kills of Mastodon processes.
• Application: Increased error rates or timeouts in Mastodon's Sidekiq job queue related to ActivityPub::ProcessCollectionService or similar federation processing jobs.

Mastodon has released patched versions that enforce limits on the number of poll options for federated posts. Administrators should upgrade to the appropriate patched release for their branch: v4.3.18 (for 4.3.x), v4.4.12 (for 4.4.x), or v4.5.5 (for 4.5.x). No configuration-based workaround is documented; upgrading is the only recommended remediation. Note that v4.5.5 requires asset recompilation as part of the upgrade process (GitHub v4.3.18, GitHub v4.4.12, GitHub v4.5.5).