CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2025-35965
High (7.5) in mattermost mattermost server. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost/server/v8 8.0.0-20250218121836-2b5275d87136.
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-689c-xq7x-xjwf | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20250218121836-2b5275d87136 | 8.0.0-20250218121836-2b5275d87136 |
| GHSA-689c-xq7x-xjwf | Go | github.com/mattermost/mattermost-plugin-playbooks | >=2.0.0 | no fix published |
| GHSA-689c-xq7x-xjwf | Go | github.com/mattermost/mattermost/server/v8 | >=10.4.0 | no fix published |
| GHSA-689c-xq7x-xjwf | Go | github.com/mattermost/mattermost/server/v8 | >=10.5.0 | no fix published |
| GHSA-689c-xq7x-xjwf | Go | github.com/mattermost/mattermost/server/v8 | >=9.11.0 | no fix published |
| GHSA-689c-xq7x-xjwf | Go | github.com/mattermost/mattermost-plugin-playbooks | <1.41.0 | 1.41.0 |
| GO-2025-3643 | Go | github.com/mattermost/mattermost-plugin-playbooks | all versions | no fix published |
| GO-2025-3643 | Go | github.com/mattermost/mattermost-plugin-playbooks | <1.41.0 | 1.41.0 |
| GO-2025-3643 | Go | github.com/mattermost/mattermost-server | >=9.11.0+incompatible | no fix published |
| GO-2025-3643 | Go | github.com/mattermost/mattermost-server | >=10.4.0+incompatible | no fix published |
| GO-2025-3643 | Go | github.com/mattermost/mattermost-server | >=10.5.0+incompatible | no fix published |
| GO-2025-3643 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2025-3643 | Go | github.com/mattermost/mattermost-server/v6 | all versions | no fix published |
| GO-2025-3643 | Go | github.com/mattermost/mattermost/server/v8 | all versions | no fix published |
| GO-2025-3643 | Go | github.com/mattermost/mattermost/server/v8 | all versions | no fix published |
| GO-2025-3643 | Go | github.com/mattermost/mattermost/server/v8 | all versions | no fix published |
| GO-2025-3643 | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20250218121836-2b5275d87136 | 8.0.0-20250218121836-2b5275d87136 |