Security Advisory

CVE-2026-59825

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-18 15:07:14

Last updated 2026-08-18 15:51:15

Assigner GitHub_M

CVSS score 7.4

State PUBLISHED

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.

← Browse all CVEs View on cve.org ↗