CVE-2025-14822

LOW

Mattermost 10.11.0-10.11.8 - Authenticated Denial of Service via Hashtag Processing

Title source: llm

Description

Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens

References (1)

Core 1

Core References

Vendor Advisory

https://mattermost.com/security-updates

Scores

CVSS v3 3.1

EPSS 0.0032

EPSS Percentile 23.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-770 CWE-407

Status published

Products (2)

mattermost/mattermost-server 10.11.0 - 10.11.9Go

mattermost/mattermost_server 10.11.0 - 10.11.9

Published Jan 16, 2026

Tracked Since Feb 18, 2026