CVE-2026-23963: 
NixOS vulnerability analysis and mitigation

CVE-2026-23963 is a resource exhaustion vulnerability in Mastodon, the open-source ActivityPub-based social network server, caused by missing length limits on list names, filter names, and filter keywords. Any authenticated local user can set arbitrarily long strings in these fields, leading to disproportionate storage and computing resource consumption. The vulnerability affects all Mastodon versions prior to 4.3.18, versions 4.4.0 through 4.4.11, and versions 4.5.0 through 4.5.4. It was published on January 22, 2026, with patches released on January 20, 2026. The CVSS v3.1 base score is 4.3 (Medium) per the official GitHub Security Advisory, though some sources score it as high as 6.5 (GitHub Advisory, Feedly).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): Mastodon's API endpoints for creating or updating lists, filters, and filter keywords do not enforce any maximum string length on the name or keyword fields. An authenticated user can submit HTTP API requests with arbitrarily large payloads for these fields, which the server accepts, stores in the database, and processes without restriction. This requires only a low-privilege authenticated account (or a malicious API client approved by a user) and no special configuration. No public proof-of-concept code has been identified (GitHub Advisory, Feedly).

Successful exploitation degrades server availability by consuming disproportionate database storage and computing resources, potentially affecting all users on the Mastodon instance. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Additionally, a user can render their own web interface unusable by setting excessively long strings, either intentionally or by unknowingly authorizing a malicious API client (GitHub Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of active in-the-wild exploitation as of the time of publication. The vulnerability requires a low-privilege authenticated account, making it accessible to any registered local user on a vulnerable Mastodon instance. The EPSS score is approximately 0.039% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

1. Obtain authentication: Register or log in to a vulnerable Mastodon instance (any version prior to 4.3.18, 4.4.12, or 4.5.5) as a local user, or obtain an OAuth token from a user who has approved a malicious API client.
2. Identify target API endpoints: Locate the Mastodon REST API endpoints for list management (POST /api/v1/lists, PUT /api/v1/lists/:id) and filter management (POST /api/v1/filters, PUT /api/v1/filters/:id, including filter keyword sub-resources).
3. Craft oversized payload: Construct an API request with an arbitrarily large string (e.g., megabytes of data) in the title field for lists or the title/phrase fields for filters and filter keywords.
4. Submit repeated requests: Send multiple such requests to maximize database storage consumption and trigger repeated processing of large strings, exhausting server storage and CPU resources.
5. Observe impact: The server stores the oversized data without rejection, leading to degraded performance or unavailability for other users on the instance (GitHub Advisory).

• Network: Unusual API requests to /api/v1/lists, /api/v1/filters, or related endpoints with abnormally large request body sizes (e.g., payloads significantly exceeding typical user input).
• Logs: Web server or application logs showing repeated POST/PUT requests to list or filter endpoints from the same authenticated user or API token with large Content-Length values.
• Database: Unexpectedly large entries in the lists, custom_filters, or custom_filter_keywords tables; rapid growth in database storage size.
• System: Elevated CPU or memory usage on the Mastodon application or database server without a corresponding increase in legitimate user activity.

Mastodon has released patched versions addressing this vulnerability: v4.5.5, v4.4.12, and v4.3.18. Administrators should upgrade to the appropriate patched version for their branch as soon as possible. As interim measures, consider implementing network-level or WAF-based controls to restrict API access to trusted clients, and monitor server resource usage and access logs for suspicious list/filter creation activity from authenticated users (GitHub Advisory, v4.3.18 Release, v4.4.12 Release, v4.5.5 Release).

The vulnerability was reported by researcher daprice and the advisory was published by Mastodon maintainer renchap on January 20, 2026. The fix was bundled with three other security fixes in the same patch releases, suggesting a coordinated security update cycle. No significant broader media coverage or notable community controversy has been identified beyond the standard advisory publication (GitHub Advisory).