CVE-2026-72914 mastodon CVE debrief

Who should care

Defenders responsible for Mastodon server administration and security should assess exposure and apply patches to prevent resource exhaustion. This includes operators managing Mastodon instances, security teams monitoring for potential DoS attacks, and platform administrators ensuring version updates are applied. Vulnerability management teams should also review and prioritize patching to mitigate potential risks.

Why it matters

CVE-2026-72914 is a high-severity vulnerability in Mastodon that allows anonymous callers to exhaust server resources. Defenders should prioritize verifying exposure and applying patches to prevent resource exhaustion.

• Server resource exhaustion due to repeated long-running SQL queries.
• Potential for denial-of-service (DoS) attacks.
• Need for verification of Mastodon server versions and configurations.
• Priority for applying patches to prevent resource exhaustion.

Technical summary

The administrative statistics endpoints in Mastodon handled authorization only after beginning expensive calculations, allowing anonymous callers to submit parameters that caused long-running SQL queries, exhausting server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1. Affected deployments should prioritize verifying exposure and applying patches to prevent resource exhaustion. The vulnerability allows repeated requests to exhaust server resources, potentially leading to denial-of-service (DoS) attacks.

Defensive priority

Defenders should prioritize verifying exposure and applying patches to prevent resource exhaustion.

Recommended defensive actions

• Verify exposure by checking Mastodon server versions and configurations.
• Apply patches to upgrade to versions 4.4.21, 4.5.14, 4.6.4, or 4.7.0-beta.1.
• Monitor server resources for signs of exhaustion.
• Implement compensating controls to limit API access.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the administrative statistics endpoints handling authorization only after beginning expensive calculations. This allows for repeated requests to exhaust server resources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.