CVE-2021-37865

MEDIUM

Mattermost < 6.2.0 - Authenticated Denial of Service via Crafted GIF File Upload

Title source: llm

Description

Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://mattermost.com/security-updates/

Permissions Required x_refsource_misc

https://hackerone.com/reports/1428260

Scores

CVSS v3 4.3

EPSS 0.0060

EPSS Percentile 69.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-400

Status published

Products (1)

mattermost/mattermost < 6.2.0

Published Jan 18, 2022

Tracked Since Feb 18, 2026