PT-2026-3244 · Mattermost · Mattermost

Daw10 · Published 2025-12-10 · Updated 2026-03-03 · CVE-2025-14435

Positive Technologies · (AI Summary)

CVSS v3.1

6.8

Medium

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.8 Mattermost versions 11.1.x through 11.1.1 Mattermost versions 11.0.x through 11.0.6

Description The software contains a flaw that does not prevent infinite re-renders when API errors occur. Authenticated users can trigger unbounded component re-render loops, leading to application-level Denial of Service (DoS).

Recommendations Update Mattermost to a version later than 10.11.8. Update Mattermost to a version later than 11.1.1. Update Mattermost to a version later than 11.0.6.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

BDU:2026-00601

CVE-2025-14435

GHSA-MX8M-V8QM-XWR8

GO-2026-4326

SUSE-SU-2026:0757-1

Affected Products

Mattermost

References · 121

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4326 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mx8m-v8qm-xwr8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14435 · Security Note
• https://bdu.fstec.ru/vul/2026-00601 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14435 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/9f7629504bc93f79af8d606329c025a687e143cd · Note
• https://github.com/mattermost/mattermost/commit/cc6b77b271324796b72f1e6b82dba85a86462f9f · Note
• https://github.com/mattermost/mattermost/commit/613bb616cd62c584a606919e6978688e7b87d81e · Note
• https://suse.com/security/cve/CVE-2026-0998 · Note
• https://suse.com/security/cve/CVE-2026-21434 · Note
• https://suse.com/security/cve/CVE-2025-64641 · Note
• https://suse.com/security/cve/CVE-2026-27586 · Note