GHSA-mcw6-3256-64gg
GitHub Security Advisory
Mattermost Server doesn't limit the number of user preferences
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.
Affected Packages
Go
github.com/mattermost/mattermost/server/v8
Affected versions:
8.1.0
(fixed in 8.1.11)
Go
github.com/mattermost/mattermost/server/v8
Affected versions:
9.3.0
(fixed in 9.3.3)
Go
github.com/mattermost/mattermost/server/v8
Affected versions:
9.4.0
(fixed in 9.4.4)
Go
github.com/mattermost/mattermost/server/v8
Affected versions:
9.5.0
(fixed in 9.5.2)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: August 2, 2025 6:46 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.