GO-2025-4184

None

CVSS

—

EPSS

—

Published

Dec 8, 2025

CISA due date

—

The record

Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names in github.com/mattermost/mattermost-server

Affected packages

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost-server	0	4.2.2+incompatible
Go	github.com/mattermost/mattermost-server	0	4.2.2
Go	github.com/mattermost/mattermost-server	4.3.0-rc1	4.3.4
Go	github.com/mattermost/mattermost-server	4.4.0-rc1	4.4.5
Go	github.com/mattermost/mattermost-server	4.5.0-rc1	4.5.0
go	github.com/mattermost/mattermost-server	4.3.0-rc1	4.3.4
go	github.com/mattermost/mattermost-server	4.4.0-rc1	4.4.5
go	github.com/mattermost/mattermost-server	4.5.0-rc1	4.5.0

Related vulnerabilities

GO-2026-4305 Mattermost Server vulnerable to CSRF if CORS is enabled in… Also affects github.com/mattermost/mattermost-server
GO-2025-4259 Mattermost doesn't validate user channel membership when attaching Mattermost posts as… Also affects github.com/mattermost/mattermost-server
GO-2026-4326 Mattermost is vulnerable to DoS due to infinite re-renders on API errors in… Also affects github.com/mattermost/mattermost-server
GO-2025-4260 Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created… Also affects github.com/mattermost/mattermost-server
GO-2026-4325 Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in… Also affects github.com/mattermost/mattermost-server
GO-2026-4282 Mattermost Server is vulnerable to channel invisibility DoS via misformatted post in… Also affects github.com/mattermost/mattermost-server
GO-2026-4496 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost… Also affects github.com/mattermost/mattermost-server
GO-2026-4520 Mattermost fails to properly validate login method restrictions in… Also affects github.com/mattermost/mattermost-server