VULNERABILITY INTELLIGENCE

CVE-2025-35965

CVSS score6.5 MEDIUM
EPSS probability0.40%
CISA KEVNot currently listed
Published2025-04-24
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Description

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.

Weakness classification

  • CWE-770: Allocation of Resources Without Limits or Throttling

Primary references