CVE-2026-50129: Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-24 · updated 2026-06-25
Weakness: CWE-248

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception vulerability), due to missing exception handling in the math sanitizer. Malformed <math> nodes can result in a DoS of a whole server or targeted users services, depending on the type of action that includes the malformed nodes and the services interacting with it. This vulnerability is fixed in 4.5.11, 4.4.18, and 4.3.24.

Affected products

mastodon: from 4.5.0-beta.1, < 4.5.11; from 4.4.0-beta.1, < 4.4.18; before 4.3.24

References

https://github.com/mastodon/mastodon/security/advisories/GHSA-qrgq-9fx2-vf2r

Get alerted when CVE-2026-50129 or the next vulnerability affects your stack