medium6.5
CVE-2025-35965
Mattermost Playbooks fails to validate the uniqueness and quantity of task actions
Impact
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250218121836-2b5275d87136 | 8.0.0-20250218121836-2b5275d87136 |
| go | github.com/mattermost/mattermost-plugin-playbooks | >= 2.0.0, < 2.1.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | from 9.11.0 before 9.11.11 from 10.4.0 before 10.4.3 Version 10.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://mattermost.com/security-updates
- https://github.com/advisories/GHSA-689c-xq7x-xjwf
- https://nvd.nist.gov/vuln/detail/CVE-2025-35965
- https://github.com/mattermost/mattermost-plugin-playbooks/commit/bf2633dad09f5768ce2bea4b7c5ffb74050052a8
- https://github.com/mattermost/mattermost/commit/2b5275d87136f07e016c8eca09a2f004b31afc8a