Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-35965 EUVD-2025-12105GHSA-689c-xq7x-xjwfGO-2025-3643

DoS in Mattermost Playbooks via Excessive Task Actions

Published Apr 24, 2025 · Updated Apr 24, 2025 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-plugin-playbooks Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost 10.4.0 – ≤ 10.4.2, 10.5.0, 9.11.0 – ≤ 9.11.10 10.6.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250424T181457-1.1 openSUSE-SU-2025:15033-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-plugin-playbooks >= 2.0.0 — GHSA-689c-xq7x-xjwf
Go github.com/mattermost/mattermost-plugin-playbooks < 1.41.0 1.41.0 GHSA-689c-xq7x-xjwf
Go github.com/mattermost/mattermost-plugin-playbooks all versions — GO-2025-3643
Go github.com/mattermost/mattermost-server >= 9.11.0+incompatible — GO-2025-3643
Go github.com/mattermost/mattermost-server >= 10.4.0+incompatible — GO-2025-3643
Go github.com/mattermost/mattermost-server >= 10.5.0+incompatible — GO-2025-3643
Go github.com/mattermost/mattermost-server/v5 all versions — GO-2025-3643
Go github.com/mattermost/mattermost-server/v6 all versions — GO-2025-3643
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250218121836-2b5275d87136 8.0.0-20250218121836-2b5275d87136 GHSA-689c-xq7x-xjwf
Go github.com/mattermost/mattermost/server/v8 >= 10.4.0 — GHSA-689c-xq7x-xjwf
Go github.com/mattermost/mattermost/server/v8 >= 10.5.0 — GHSA-689c-xq7x-xjwf
Go github.com/mattermost/mattermost/server/v8 >= 9.11.0 — GHSA-689c-xq7x-xjwf
Go github.com/mattermost/mattermost/server/v8 all versions — GO-2025-3643

Advisories 1

References