CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LCVE-2024-1953
Medium (4.3) in mattermost mattermost server. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost/server/v8 8.1.9, 9.2.5, 9.3.1.
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-11-01)
- CWEs
- CWE-770, CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vm9m-57jr-4pxh | Go | github.com/mattermost/mattermost/server/v8 | >=9.4.0 <9.4.2 | 9.4.2 |
| GHSA-vm9m-57jr-4pxh | Go | github.com/mattermost/mattermost/server/v8 | >=9.3.0 <9.3.1 | 9.3.1 |
| GHSA-vm9m-57jr-4pxh | Go | github.com/mattermost/mattermost/server/v8 | >=9.2.0 <9.2.5 | 9.2.5 |
| GHSA-vm9m-57jr-4pxh | Go | github.com/mattermost/mattermost/server/v8 | <8.1.9 | 8.1.9 |
| GO-2024-2594 | Go | github.com/mattermost/mattermost-server | >=9.2.0+incompatible <9.2.5+incompatible >=9.3.0+incompatible <9.3.1+incompatible >=9.4.0+incompatible <9.4.2+incompatible | 9.2.5+incompatible, 9.3.1+incompatible, 9.4.2+incompatible |
| GO-2024-2594 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2024-2594 | Go | github.com/mattermost/mattermost-server/v6 | all versions | no fix published |
| GO-2024-2594 | Go | github.com/mattermost/mattermost/server/v8 | all versions | no fix published |