High severity · published Jun 24, 2026
CVE-2026-50129
Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception vulerability), due to missing exception handling in the math sanitizer. Malformed <math> nodes can result in a DoS of a whole server or targeted users services, depending on the type of action that includes the malformed nodes and the services interacting with it. This vulnerability is fixed in 4.5.11, 4.4.18, and 4.3.24.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mastodon · mastodon
>= 4.5.0-beta.1, < 4.5.11; >= 4.4.0-beta.1, < 4.4.18; < 4.3.24 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-50129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-50129
github.com
https://github.com/mastodon/mastodon/security/advisories/GHSA-qrgq-9fx2-vf2r
More from mastodon
8.7
CVE-2026-46348
Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)
8.6
CVE-2026-47389
Mastodon: SSRF protection bypass on older Ruby versions
8.2
CVE-2026-27468
Mastodon may allow unconfirmed FASP to make subscriptions
7.5
CVE-2026-72915
Mastodon: Personally-identifying information disclosure due to incorrect access control validation
7.5
CVE-2026-72914
Mastodon: Exhausting data by an unauthenticated request to the admin retention API