Mattermost Password Length Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Mattermost versions 11.3.x through 11.3.0, 11.2.x through 11.2.2, and 10.11.x through 10.11.10. The issue arises because these versions do not properly manage very long passwords. This flaw allows an attacker to overload the server's CPU and memory by executing login attempts with multi-megabyte passwords.

Impact

Exploitation of this vulnerability can cause significant server resource exhaustion, leading to degraded performance or unresponsiveness.

Remediation

Users can upgrade to Mattermost versions 11.5.0 or 11.4.0 to address this vulnerability.