CVE-2025-14822

Low · 3.1

Mattermost is vulnerable to CPU exhaustion via crafted HTTP request

CVSS

3.1

EPSS

0.3%

Published

Jan 16, 2026

CISA due date

—

The record

Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens.

Affected packages

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost-server	10.11.0	10.11.9
Go	github.com/mattermost/mattermost-server	10.11.0+incompatible	10.11.9+incompatible
Go	github.com/mattermost/mattermost-server	11.0.0	11.2.0
go	github.com/mattermost/mattermost-server	10.11.0	10.11.9
go	github.com/mattermost/mattermost-server	11.0.0	11.2.0
openSUSE:Leap 15.6	govulncheck-vulndb	0	0.0.20260226T182644-150000.1.149.1

Related vulnerabilities

GO-2026-4325 Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in… Same vulnerability
GO-2026-4305 Mattermost Server vulnerable to CSRF if CORS is enabled in… Also affects github.com/mattermost/mattermost-server
GO-2025-4259 Mattermost doesn't validate user channel membership when attaching Mattermost posts as… Also affects github.com/mattermost/mattermost-server
GO-2026-4326 Mattermost is vulnerable to DoS due to infinite re-renders on API errors in… Also affects github.com/mattermost/mattermost-server
GO-2025-4260 Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created… Also affects github.com/mattermost/mattermost-server
GO-2026-4282 Mattermost Server is vulnerable to channel invisibility DoS via misformatted post in… Also affects github.com/mattermost/mattermost-server
GO-2026-4496 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost… Also affects github.com/mattermost/mattermost-server
GO-2026-4520 Mattermost fails to properly validate login method restrictions in… Also affects github.com/mattermost/mattermost-server