Cloudanix VulnDB

CVE-2025-14435

Medium · 6.8

Mattermost is vulnerable to DoS due to infinite re-renders on API errors

CVSS

6.8

EPSS

0.3%

Published

Jan 16, 2026

CISA due date

—

The record

Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/mattermost/mattermost-server 10.11.0 10.11.9
Go github.com/mattermost/mattermost-server 10.11.0+incompatible 10.11.9+incompatible
Go github.com/mattermost/mattermost-server 11.0.0 11.0.7
Go github.com/mattermost/mattermost-server 11.1.0 11.1.2
go github.com/mattermost/mattermost-server 10.11.0 10.11.9
go github.com/mattermost/mattermost-server 11.0.0 11.0.7
go github.com/mattermost/mattermost-server 11.1.0 11.1.2
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260226T182644-150000.1.149.1

Related vulnerabilities