What’s Vulnerable › Vulnerabilities

CVE-2023-42451: Mastodon Invalid Domain Name Normalization vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-19 · updated 2026-06-17
• Weakness: CWE-706

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.

Affected products

• mastodon: before 3.5.14; from 4.0.0 before 4.0.10; from 4.1.0 before 4.1.8; 4.2.0-beta1, 4.2.0-beta2, 4.2.0-beta3, 4.2.0-rc1 — fixed in 3.5.14, 4.0.10, 4.1.8

How to fix

Upgrade to a fixed version: mastodon 3.5.14, 4.0.10, 4.1.8. Check the vendor advisory for mitigations.

References

• https://github.com/mastodon/mastodon/commit/eeab3560fc0516070b3fb97e089b15ecab1938c8
• https://github.com/mastodon/mastodon/security/advisories/GHSA-v3xf-c9qf-j667
• https://github.com/mastodon/mastodon/commit/eeab3560fc0516070b3fb97e089b15ecab1938c8
• https://github.com/mastodon/mastodon/security/advisories/GHSA-v3xf-c9qf-j667

Get alerted when CVE-2023-42451 or the next vulnerability affects your stack