6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-14435

CVE-2025-14435: Mattermost is vulnerable to DoS due to infinite re-renders on API errors

Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-14435

CVE-2025-14435:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 10.11.0, <= 10.11.8	10.11.9
github.com/mattermost/mattermost-server	go	>= 11.1.0, <= 11.1.1	11.1.2
github.com/mattermost/mattermost-server	go	>= 11.0.0, <= 11.0.6	11.0.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in several React components within the Mattermost web application. Specifically, useEffect hooks in the UserProfile, Member, and UserDetails components were incorrectly configured. These hooks were designed to fetch information about remote users. However, their dependency arrays included state variables that were modified as a result of the API calls made within the hooks themselves.

When an API request triggered by the useEffect failed, the error handling logic would update the component's state. This state update would then cause the component to re-render. Because the modified state variable was also in the useEffect's dependency array, the hook would be triggered again, initiating another API call. This sequence created an infinite loop of API calls and re-renders, consuming excessive client-side resources and leading to a Denial of Service (DoS) that would freeze the user's browser tab.

The patches address this issue by removing the problematic state variables from the dependency arrays of the useEffect hooks. This ensures that an API error does not re-trigger the hook, thus breaking the infinite loop.

Vulnerable functions

UserProfile

webapp/channels/src/components/user_profile/user_profile.tsx

The `useEffect` hook in the `UserProfile` component was vulnerable to an infinite re-render loop. The dependency array included `remoteNames` and `actions`. If the `fetchRemoteClusterInfo` action resulted in an API error, it could trigger a state update that changed `remoteNames`, causing the `useEffect` to run again. This cycle would repeat, leading to a Denial of Service in the user's browser. The patch removes `remoteNames` and `actions` from the dependency array, breaking the loop.

Member

webapp/channels/src/components/channel_members_rhs/member.tsx

The `useEffect` hook in the `Member` component had a dependency on `member.remoteDisplayName` and `actions.fetchRemoteClusterInfo`. An API error from the `fetchRemoteClusterInfo` action could cause a state change that modified `member.remoteDisplayName`, which in turn would re-trigger the `useEffect` hook, creating an infinite loop and causing a Denial of Service. The fix removes these dependencies from the hook's dependency array.

UserDetails

webapp/channels/src/components/more_direct_channels/list_item/user_details/user_details.tsx

The `useEffect` hook in the `UserDetails` component was susceptible to an infinite re-render loop. It depended on `remoteDisplayName` and `actions.fetchRemoteClusterInfo`. If the `fetchRemoteClusterInfo` action failed, it could lead to a state update affecting `remoteDisplayName`, which would cause the `useEffect` to be called again, resulting in a loop and a client-side Denial of Service. The patch mitigates this by removing the unstable dependencies from the dependency array.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.