{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "3.1.5"
              },
              {
                "fixed": "4.2.24"
              }
            ]
          },
          "events": [
            {
              "introduced": "661f3f26b041dd6f1f0ea646e55616f7139bb957"
            },
            {
              "fixed": "ca1c58d5f69aae80fe22ac8ae982ae4ba2bf4165"
            }
          ],
          "repo": "https://github.com/mastodon/mastodon",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "4.3.0"
              },
              {
                "fixed": "4.3.11"
              }
            ]
          },
          "events": [
            {
              "introduced": "ab36c152f9e5f9054798504354365dcaef4e5c43"
            },
            {
              "fixed": "42594f253e64c559ca2462abab0623dddc82f54c"
            }
          ],
          "repo": "https://github.com/mastodon/mastodon",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "4.4.0"
              },
              {
                "fixed": "4.4.3"
              }
            ]
          },
          "events": [
            {
              "introduced": "69e14246b838443985a541e97327494b8d2fdffb"
            },
            {
              "fixed": "5478ef9b32be0c7ac8f86330760485a7531d218a"
            }
          ],
          "repo": "https://github.com/mastodon/mastodon",
          "type": "GIT"
        }
      ]
    },
    {
      "ranges": [
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "3.1.5"
              },
              {
                "fixed": "4.2.24"
              },
              {
                "introduced": "4.3.0"
              },
              {
                "fixed": "4.3.11"
              },
              {
                "introduced": "4.4.0"
              },
              {
                "fixed": "4.4.3"
              }
            ]
          },
          "events": [
            {
              "introduced": "661f3f26b041dd6f1f0ea646e55616f7139bb957"
            },
            {
              "fixed": "ca1c58d5f69aae80fe22ac8ae982ae4ba2bf4165"
            },
            {
              "introduced": "ab36c152f9e5f9054798504354365dcaef4e5c43"
            },
            {
              "fixed": "42594f253e64c559ca2462abab0623dddc82f54c"
            },
            {
              "introduced": "69e14246b838443985a541e97327494b8d2fdffb"
            },
            {
              "fixed": "5478ef9b32be0c7ac8f86330760485a7531d218a"
            }
          ],
          "repo": "https://github.com/tootsuite/mastodon",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-84ch-6436-c7mg"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54879.json"
  },
  "details": "Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.",
  "id": "CVE-2025-54879",
  "modified": "2026-04-01T23:10:29.670781961Z",
  "published": "2025-08-05T23:39:59.130Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.3"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54879.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-84ch-6436-c7mg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54879"
    },
    {
      "type": "FIX",
      "url": "https://github.com/mastodon/mastodon/commit/e2592419d93fb41be03c2f3ff6a122fecb0e0952"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails"
}