Mattermost Plugins Request Body Size Limitation Vulnerability in Webhook Endpoint Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in Mattermost Plugins versions through 2.1.3.0. The issue arises because the {{/changes}} webhook endpoint does not properly limit the size of incoming JSON payloads. This oversight enables authenticated attackers to send excessively large payloads, causing memory exhaustion and disrupting service.

Impact

Exploitation of this vulnerability leads to memory exhaustion on the server, causing a denial-of-service condition where the application becomes unresponsive or unavailable.

Remediation

Users can upgrade to Mattermost Plugins version 2.1.3.1 or later, where this vulnerability has been addressed.