CVE-2021-37865

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Jan 18, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-378667.5Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allowsCVE-2021-378674.3Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authentiCVE-2021-37877.8A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MCVE-2021-37886.8An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access uCVE-2021-37894.6An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physCVE-2021-37906.5A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated CVE-2021-379099.8WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry withoCVE-2021-37916.5An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated atCVE-2021-379105.3ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticCVE-2021-379118.8The management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any syCVE-2021-379129.8The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting pCVE-2021-379139.8The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page
CVE-2021-37865: Medium severity, CVSS 5.7 | Vulnix