Mastodon's lack of limitation on poll options per remote post allows an attacker to craft a single post with an extremely large number of poll options. The processing of such a post leads to a disproportionate consumption of CPU, memory and network resources on both the server and client sides. The resulting exhaustion can bring the server to a halt or cause client applications to freeze, producing a denial of service. This weakness is identified as CWE‑770, Excessive Resource Consumption.

The affected product is the Mastodon social networking platform, maintained by JoinMastodon. Versions of Mastodon prior to v4.3.18, v4.4.12 or v4.5.5 are vulnerable. The issue has been resolved in releases v4.3.18, v4.4.12, and v4.5.5 and any subsequent patches. Administrators running those earlier releases should be aware that any remote post containing a large poll list can trigger this behavior.

The CVSS score of 7.5 indicates a high severity of the vulnerability. The EPSS score of < 1% suggests that the likelihood of exploitation at this time is low, and it is not currently listed in the CISA KEV catalog. Nevertheless, the attack vector is remote and can be performed by any user who can submit a post, since no special credentials or elevated privileges are required. An attacker can therefore freely issue a single oversized poll that will consume resources on all clients that receive the post, potentially leading to service disruption for the entire user base.