CVE-2024-2446

Name of the Vulnerable Software and Affected Versions Mattermost versions 8.1.x through 8.1.9 Mattermost versions 9.2.x through 9.2.5 Mattermost versions 9.3.x through 9.3.1 Mattermost versions 9.4.x through 9.4.2

Description The issue allows an authenticated attacker to crash the client applications of other users via large, crafted messages, due to the failure to limit the number of @-mentions processed per message.

Recommendations For Mattermost versions 8.1.x through 8.1.9, update to version 8.1.10 or later. For Mattermost versions 9.2.x through 9.2.5, update to version 9.2.6 or later. For Mattermost versions 9.3.x through 9.3.1, update to version 9.3.2 or later. For Mattermost versions 9.4.x through 9.4.2, update to version 9.4.3 or later.