Mastodon server versions before 4.5.5, 4.4.12, and 4.3.18 lack maximum length enforcement for list names, filter names, and filter keywords. A local user can therefore create entries with arbitrarily long strings, which forces the server to allocate extra storage and requires extra processing time. This can degrade the performance and usability of the web interface, potentially making it unusable for that user. No external attack vector is required; the flaw can be exercised by anyone who has access to the server's local user interface or API.

The vulnerability affects Mastodon servers running the open‑source social network platform. Any installation using versions older than 4.5.5, 4.4.12, or 4.3.18 is impacted. Updating to v4.5.5, v4.4.12, or v4.3.18 patches the flaw.

The CVSS v3 score is 4.3, indicating moderate severity, and the EPSS score is below 1%, implying that the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local user privileges and can be carried out without additional network exposure. Because the impact is limited to resource exhaustion on the affected server, the threat remains largely contained to the individual user's account or to infrastructure suffering from a sudden spike in storage or CPU usage.