CVE-2025-54879— Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-54879
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
Source: CVE Program / CVE List V5
Vulnerability Description
Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
Mastodon 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mastodon是Mastodon开源的一款基于ActivityPub的开源社交网络服务器。 Mastodon 4.2.24及之前版本、4.3.11及之前版本和4.4.3及之前版本存在安全漏洞，该漏洞源于速率限制配置错误，可能导致拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-54879
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-54879
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-54879 (1)
IV. Related Vulnerabilities
Same product: mastodon
- CVE-2026-50129
Mastodon: Persistent anonymous DoS via unhandled NoMethodErr - CVE-2026-50128
Mastodon: Spoofing of attribution domains - CVE-2026-48028
Mastodon: Removal of integrity-protected JSON entries from s - CVE-2026-47389
Mastodon: SSRF protection bypass on older Ruby versions - CVE-2026-46349
Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restru
Same vendor: mastodon
- CVE-2026-50129
Mastodon: Persistent anonymous DoS via unhandled NoMethodErr - CVE-2026-50128
Mastodon: Spoofing of attribution domains - CVE-2026-48028
Mastodon: Removal of integrity-protected JSON entries from s - CVE-2026-47389
Mastodon: SSRF protection bypass on older Ruby versions - CVE-2026-46349
Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restru
Same weakness: CWE-770
- CVE-2026-46405
OpenBao's Kerberos Auth Method Accumulates Unaccessible Toke - CVE-2026-15972
Unauthenticated denial of service via unbounded external gRP - CVE-2026-19015
Uncontrolled resource consumption in the Consul Connect CA r - CVE-2026-19014
Uncontrolled resource consumption in the Consul Connect auth - CVE-2025-71410
Malicious Link Control Frames Can Cause Loss of CPDLC Functi
V. Comments for CVE-2025-54879
No comments yet