Go/github.com/mattermost/mattermost-server CVE-2025-14822: medium 6.5, EPSS 0.35%
Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in github.com/mattermost/mattermost-server
Action: Upgrade github.com/mattermost/mattermost-server to 10.11.9+incompatible or later.
go get github.com/mattermost/mattermost-server@v10.11.9+incompatiblego get github.com/mattermost/mattermost-server@v11.2.0+incompatibleAffected
| introduced | fixed | last affected |
|---|---|---|
| 10.11.0+incompatible | 10.11.9+incompatible | - |
| 11.0.1+incompatible | 11.2.0+incompatible | - |
Fixed versions
| 10.11.9+incompatible | 11.2.0+incompatible |
Sources
- osv: GO-2026-4325
- nvd: CVE-2025-14822
- https://github.com/advisories/GHSA-9r42-rhw3-2222
- https://github.com/mattermost/mattermost/commit/4d86263f5430d0eb991fc52ec886cf778cb072e6
- https://github.com/mattermost/mattermost/commit/b3d6c0c564c1a79e54e5105d0a8b60fc58a2bdee
- https://mattermost.com/security-updates
CVE-2025-14822 · published · modified · JSON