CVE-2025-14822

LOW

Mattermost <10.11.9 - DoS

Title source: llm

Description

Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens

References (1)

[Vendor Advisory] https://mattermost.com/security-updates

Scores

CVSS v3 3.1

EPSS 0.0002

EPSS Percentile 4.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Classification

CWE

CWE-407 CWE-770

Status published

Affected Products (2)

mattermost/mattermost_server < 10.11.9

mattermost/mattermost-server < 10.11.9Go

Timeline

Published Jan 16, 2026

Tracked Since Feb 18, 2026