[ blog ]
Mastodon Updated to 4.6.4
published
We have updated C.IM to Mastodon v4.6.4.
Mastodon released v4.6.4 on July 27, 2026. The update patches three security issues along with bugs in the web interface and federation code.
Security fixes
Mastodon rates GHSA-7jvv-fhmg-wpfw high severity. An admin statistics endpoint checked permissions only after running its queries, so an anonymous attacker could trigger expensive SQL work and exhaust server resources. All Mastodon 4.6 releases before v4.6.4 are affected.
Mastodon also rates GHSA-hx34-2pfw-2qfj high severity. A signed-in local user could access the email address and last IP address used by another local user listed in a collection. The bug affects versions from v4.6.0-beta.1 up to, but not including, v4.6.4.
GHSA-vwhj-3g83-v276 is a medium-severity SSRF bypass. Mastodon’s private-address filter missed IPv4-compatible IPv6 addresses. On systems that support this obsolete address format, an attacker could make Mastodon send requests to a loopback interface.
The two high-severity advisories credit Claude, Anthropic’s AI assistant, with finding the bugs. Ada Logics manually triaged the reports in collaboration with Anthropic Research.
Fixes users may notice
Autosuggestions in the web interface now consider a second word, which helps when searching for a display name with multiple words. A related fix covers hashtags that use non-Latin characters.
The patch also fixes several visible problems:
- Voting works again in polls without an expiration date
- Very wide images no longer overflow posts horizontally
- Fixed emoji search and the followed-languages selector
- Saving custom profile fields no longer refreshes the page
- Follow-request actions now appear in the correct order
Administration and federation fixes
Mastodon v4.6.4 speeds up queries about users in the administration dashboard. The verify_credentials endpoint no longer includes suspended accounts in its pending follow-request count.
Deleting an account now removes its collections and followed tags, while account merges handle collections and quote posts correctly. ActivityPub fixes cover inbound relevance checks and a case where a Create activity could try to recreate a known status after its author changed.
Upgrade notes
C.IM upgraded directly from v4.6.3. Mastodon lists no database migration or external dependency changes for this patch.
Full changelog: Mastodon v4.6.4 release notes
C.IM source code: https://github.com/odotee/mastodon
[ share ]