An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service (memory consumption) via an outgoing webhook or a slash command integration.
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mattermost_server | Mattermost | * | 4.10.5 (excluding) |
| Mattermost_server | Mattermost | 5.5.0 (including) | 5.5.2 (excluding) |
| Mattermost_server | Mattermost | 5.6.0 (including) | 5.6.3 (excluding) |
| Mattermost_server | Mattermost | 5.7.0-rc1 (including) | 5.7.0-rc1 (including) |
| Mattermost_server | Mattermost | 5.7.0-rc2 (including) | 5.7.0-rc2 (including) |
| Mattermost_server | Mattermost | 5.7.0-rc3 (including) | 5.7.0-rc3 (including) |
| Mattermost_server | Mattermost | 5.7.0-rc4 (including) | 5.7.0-rc4 (including) |
| Mattermost_server | Mattermost | 5.7.0-rc5 (including) | 5.7.0-rc5 (including) |
| Mattermost_server | Mattermost | 5.7.0-rc6 (including) | 5.7.0-rc6 (including) |