Mattermost Plugins Request Body Size Limitation Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Mattermost Plugins versions through 2.3.1. The issue arises because the {{/lifecycle}} webhook endpoint does not properly limit the size of incoming JSON payloads. This oversight allows an authenticated attacker to send excessively large payloads, causing memory exhaustion on the server.

Impact

Exploitation of this vulnerability leads to memory exhaustion, causing a denial-of-service condition on the server.

Remediation

Users can upgrade to Mattermost Plugins version 2.3.2 or later, where this vulnerability has been addressed.