CVE-2024-22091

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-770

Affected software

VendorProductVersions
MattermostMattermost>= 8.1.0, <= 8.1.10; 9.6.0; >= 9.5.0, <= 9.5.2; >= 8.1.0, <= 8.1.11
mattermostmattermost_server8.1x
mattermostmattermost9.6x
mattermostmattermost9.5x
mattermostmattermost8.1x

References

Timeline

Published
Apr 26, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-220927.4in OpenHarmony v3.2.4 and prior versions allow a remote attacker bypass permission verification to install apps, although these require userCVE-2024-220938.7When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on mCVE-2024-220957.2Improper input validation in PlatformVariableInitDxe driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a priCVE-2024-220966.5In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when uCVE-2024-220979.8A double-free vulnerability exists in the BrainVision Header Parsing functionality of The Biosig Project libbiosig Master Branch (ab0ee111) CVE-2024-220988.8in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free.CVE-2024-220995.5NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth modules) allows Overflow Buffers. ThiCVE-2024-22106.4The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 viaCVE-2024-221007.8MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allowCVE-2024-221025.5Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error.CVE-2024-221035.5Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error and Denial ofCVE-2024-221045.5Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error and Denial of
CVE-2024-22091: Medium severity, CVSS 6.5 | Vulnix