Vulnerable:
Mastodon (< 4.2.7)
GoToSocial (< v0.13.3)
Pixelfed (< v0.11.12)
Misskey (< 2024.2.0)
Sharkey (Unpatched)
Firefish (< v20240217-1)
Iceshrimp (< v2023.12.4)
Probably others!
Confirmed (by inspection) Not Vulnerable:
Pleroma (Reported and fixed in 2020)
Akkoma