{"id":"CVE-2024-34535","aliases":["BIT-mastodon-2024-34535","EUVD-2024-35151","GHSA-f9c2-396j-6x9r","GHSA-q3rg-xx5v-4mxh"],"status":"published","title":"In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request...","description":"In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00376,"percentile":0.31863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2024-10-03T00:00:00Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"Bitnami","package":"mastodon","fixed_in":["4.2.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mastodon","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.9"}]}]}],"products":[{"vendor":"joinmastodon","product":"mastodon"}],"references":[{"url":"https://github.com/mastodon/mastodon/tags","tags":["Release Notes","article","web"]},{"url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-q3rg-xx5v-4mxh","tags":["Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34535","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-f9c2-396j-6x9r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34535.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-34535","description":"In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.","status":"published","published":"2024-10-03T00:00:00Z","modified":"2024-11-25T18:01:21.08Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:34:23.516065Z"}],"euvd":[{"id":"EUVD-2024-35151","description":"In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.","status":"published","published":"2024-10-03T00:00:00Z","modified":"2024-11-25T18:01:21Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:48.805983Z"}],"ghsa":[{"id":"GHSA-f9c2-396j-6x9r","title":"In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request...","description":"In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.","status":"published","published":"2024-10-03T18:30:36Z","modified":"2024-11-25T18:34:33Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:58:56.988817Z"}],"nvd":[{"id":"CVE-2024-34535","description":"In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.","status":"published","published":"2024-10-03T18:15:04.693Z","modified":"2026-06-17T07:33:35.243Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:10:30.673028Z"}],"osv":[{"id":"CVE-2024-34535","description":"In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.","status":"published","published":"2024-10-03T00:00:00Z","modified":"2026-10-28T02:31:12.695747219Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"BIT-mastodon-2024-34535","description":"In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.","status":"published","published":"2025-05-07T05:43:55.99Z","modified":"2026-09-08T08:48:13.134201996Z","updated_at":"2026-11-02T15:28:32.645004Z"}]}}