Mattermost Memory Exhaustion Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Mattermost versions 11.3.x through 11.3.0, 11.2.x through 11.2.2, and 10.11.x through 10.11.10. The issue arises from the application's failure to properly limit memory allocation when processing PSD image files. This flaw allows an authenticated attacker to upload a specially crafted PSD file, causing server memory exhaustion and disrupting service.

Impact

Exploitation of this vulnerability leads to server memory exhaustion, causing a denial-of-service condition where the server becomes unresponsive or slow due to depleted resources.

Remediation

Users can upgrade to Mattermost versions 11.5.0, 11.4.0, or 11.3.1 to address this vulnerability.