PT-2026-3241 · Mattermost · Mattermost

Catenacyber · Published 2026-01-16 · Updated 2026-03-03 · CVE-2025-14822

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.8

Description Mattermost versions 10.11.x up to and including 10.11.8 do not properly validate the size of input before processing hashtags. This allows an authenticated attacker to consume excessive CPU resources by sending a single HTTP request containing a post with a large number of space-separated tokens. The issue involves insufficient input validation when handling hashtags, potentially leading to a denial-of-service condition.

Recommendations Update to a version later than 10.11.8.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-407

Related Identifiers

BDU:2026-01035

CVE-2025-14822

GHSA-9R42-RHW3-2222

GO-2026-4325

SUSE-SU-2026:0757-1

Affected Products

Mattermost

References · 119

• https://osv.dev/vulnerability/GO-2026-4325 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14822 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01035 · Security Note
• https://osv.dev/vulnerability/GHSA-9r42-rhw3-2222 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14822 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/b3d6c0c564c1a79e54e5105d0a8b60fc58a2bdee · Note
• https://github.com/mattermost/mattermost/commit/4d86263f5430d0eb991fc52ec886cf778cb072e6 · Note
• https://suse.com/security/cve/CVE-2025-64111 · Note
• https://suse.com/security/cve/CVE-2026-0998 · Note
• https://suse.com/security/cve/CVE-2026-24122 · Note
• https://suse.com/security/cve/CVE-2026-22892 · Note
• https://suse.com/security/cve/CVE-2026-21434 · Note