CVE-2022-46405: Joinmastodon Mastodon

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.

Affected products

• Joinmastodon Mastodon: up to and including 4.0.2

Published 2022-12-04. Last modified 2026-06-17.