~ / search / GHSA-mx8m-v8qm-xwr8

GHSA-mx8m-v8qm-xwr8

Mattermost is vulnerable to DoS due to infinite re-renders on API errors

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-14435

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.9 10.11.9
Go github.com/mattermost/mattermost-server >= 11.1.0, < 11.1.2 11.1.2
Go github.com/mattermost/mattermost-server >= 11.0.0, < 11.0.7 11.0.7

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.

References

External links from the advisory. They lead to third-party sites.