-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from missing size validation in data processing paths. The patches add critical size checks in three key areas: 1) Model serialization methods (StringArray/Map/Interface.Value) now enforce maxPropSizeBytes, 2) User store operations validate() auto-responder message size. In vulnerable versions, these functions would process arbitrarily large inputs without constraints. During exploitation, API endpoints calling these functions would appear in profiler traces as they handle oversized payloads, with the model serialization methods being particularly resource-intensive. The direct correlation between added validation logic and CWE-770 (unlimited resource allocation) confirms these as vulnerable points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-server | go | < 7.1.4 | 7.1.4 |
| github.com/mattermost/mattermost-server | go | >= 7.2.0, < 7.2.1 | 7.2.1 |
| github.com/mattermost/mattermost-server | go | >= 7.3.0, < 7.3.1 | 7.3.1 |
Ongoing coverage of React2Shell