CVE-2025-35965CWE-770

DoS in Mattermost Playbooks via Excessive Task Actions

Medium · published April 24, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00396 · 32.7th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-04-24T06:49Z
EPSS history
Timeline
  • 24 APR 06:49Z
    DoS in Mattermost Playbooks via Excessive Task Actions
    cvelistv5