3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-14822

CVE-2025-14822: Mattermost is vulnerable to CPU exhaustion via crafted HTTP request

Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-14822

CVE-2025-14822:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 10.11.0, <= 10.11.8	10.11.9
github.com/mattermost/mattermost-server	go	>= 11.0.0, < 11.2.0	11.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a CPU exhaustion issue in Mattermost caused by inefficient processing of user-provided content, specifically posts containing a large number of space-separated tokens that are parsed as hashtags. The root cause is the use of inefficient string concatenation (+=) inside loops in several functions responsible for parsing and rendering markdown content. When a malicious user sends a post with thousands of such tokens, these functions consume excessive CPU resources, leading to a denial of service.

The primary vulnerable function is model.ParseHashtags, which is directly responsible for parsing hashtags from a post. The provided patches show that this function was modified to use the more performant strings.Builder for string construction and to add a size limit to the generated hashtag string. This directly addresses the vulnerability as described.

In addition to ParseHashtags, the same security patch also fixes similar performance issues in other markdown processing and rendering functions, such as markdown.renderBlockHTML, markdown.RenderInlineHTML, markdown.(*FencedCode).Code, and markdown.(*IndentedCode).Code. These functions also used inefficient string concatenation and were patched to use strings.Builder. While the vulnerability description specifically calls out hashtags, these other functions would also be triggered when processing a post and would contribute to the overall CPU exhaustion. Therefore, they are included as part of the vulnerable functions set.

Vulnerable functions

model.ParseHashtags

server/public/model/utils.go

The function `ParseHashtags` was vulnerable to CPU exhaustion due to inefficient string concatenation (`+=`) inside a loop that processes words from user input. An attacker could provide a post with a very large number of space-separated tokens that are processed as hashtags, causing excessive CPU usage. The patch replaces the string concatenation with the more efficient `strings.Builder` and adds a length check to the resulting hashtag string.

markdown.renderBlockHTML

server/public/shared/markdown/html.go

The function `renderBlockHTML` used inefficient string concatenation in a recursive manner to render markdown blocks. This could contribute to the CPU exhaustion vulnerability when processing a large, crafted markdown document. The patch replaces the string concatenation with `strings.Builder`.

markdown.RenderInlineHTML

server/public/shared/markdown/html.go

The function `RenderInlineHTML` used inefficient string concatenation to render inline markdown elements like links. This could contribute to the CPU exhaustion vulnerability when processing a large, crafted markdown document with many inline elements. The patch replaces the string concatenation with `strings.Builder`.

markdown.(*FencedCode).Code

server/public/shared/markdown/fenced_code.go

The method `Code` on the `FencedCode` struct used inefficient string concatenation within a loop to construct a code block from markdown. This could contribute to the CPU exhaustion vulnerability when processing a large, crafted markdown document with fenced code blocks. The patch replaces the string concatenation with `strings.Builder`.

markdown.(*IndentedCode).Code

server/public/shared/markdown/indented_code.go

The method `Code` on the `IndentedCode` struct used inefficient string concatenation within a loop to construct a code block from markdown. This could contribute to the CPU exhaustion vulnerability when processing a large, crafted markdown document with indented code blocks. The patch replaces the string concatenation with `strings.Builder`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.