CVE-2023-2831

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a large number of escaped characters.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Jun 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-283108.0Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2023-283117.8Microsoft Word Remote Code Execution Vulnerability CVE-2023-283126.5Azure Machine Learning Information Disclosure Vulnerability CVE-2023-283136.1Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability CVE-2023-283146.1Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability CVE-2023-283169.8A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not i CVE-2023-283175.3A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display mess CVE-2023-283185.3A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDelete CVE-2023-283197.5A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 2 CVE-2023-28327.2SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0.CVE-2023-283205.9A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, se CVE-2023-283215.9An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as