PT-2026-3244 · Mattermost · Mattermost

Daw10 · Published 2025-12-10 · Updated 2026-01-16 · CVE-2025-14435

Positive Technologies · (AI Summary)

CVSS v2.0

6.8

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.8 Mattermost versions 11.1.x through 11.1.1 Mattermost versions 11.0.x through 11.0.6

Description The software contains a flaw that does not prevent infinite re-renders when API errors occur. Authenticated users can trigger unbounded component re-render loops, leading to application-level Denial of Service (DoS).

Recommendations Update Mattermost to a version later than 10.11.8. Update Mattermost to a version later than 11.1.1. Update Mattermost to a version later than 11.0.6.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2026-00601

CVE-2025-14435

GHSA-MX8M-V8QM-XWR8

Affected Products

Mattermost

References · 13

• https://osv.dev/vulnerability/CVE-2025-14435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14435 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mx8m-v8qm-xwr8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00601 · Security Note
• https://github.com/mattermost/mattermost/commit/cc6b77b271324796b72f1e6b82dba85a86462f9f · Note
• https://github.com/mattermost/mattermost/commit/613bb616cd62c584a606919e6978688e7b87d81e · Note
• https://github.com/mattermost/mattermost/commit/9f7629504bc93f79af8d606329c025a687e143cd · Note
• https://github.com/mattermost/mattermost · Note
• https://twitter.com/VulmonFeeds/status/2012153432920957371 · Twitter Post
• https://twitter.com/CVEnew/status/2012303256131879028 · Twitter Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2026-3244 · Note
• https://github.com/advisories/GHSA-mx8m-v8qm-xwr8 · Note