Mattermost Denial-of-Service Vulnerability via Zip Bombs in File Uploads

A denial-of-service vulnerability has been identified in Mattermost versions 11.4.x through 11.4.0, 11.3.x through 11.3.1, 11.2.x through 11.2.3, and 10.11.x through 10.11.11. The issue arises because these versions do not properly validate the sizes of decompressed archive entries during file extraction. This flaw allows authenticated users with file upload permissions to exploit the vulnerability by uploading crafted zip archives containing highly compressed entries, known as zip bombs. These zip bombs can exhaust server memory, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability can cause the server to run out of memory, potentially leading to a crash or significant slowdown, disrupting normal operations and user access.

Remediation

Users can upgrade to Mattermost versions 11.5.0 or 11.6.0 to address this vulnerability.