A resource exhaustion vulnerability in Mattermost allows unauthenticated attackers to cause a denial of service by submitting multi-megabyte passwords.

The application fails to implement resource limits or throttling for incoming login requests, specifically regarding password length. An unauthenticated attacker can exploit this by sending requests containing multi-megabyte passwords, which leads to excessive CPU and memory consumption on the server.

The primary impact of this vulnerability is a denial of service, which can disrupt internal communications and operational workflows. Given the CVSS score of 7.5, the risk is classified as High because the attack is automatable and requires no authentication, making it trivial for remote actors to disrupt critical infrastructure. Organizations relying on Mattermost for real-time collaboration face significant downtime if the service is rendered unresponsive.

Immediate Action: Update Mattermost installations to versions 11.4.0, 11.3.1, 11.2.3, 10.11.11 or higher.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory spikes, during login windows to identify potential abuse.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress controller rules to limit the maximum size of incoming HTTP requests to the login endpoint.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to service availability and should be addressed as a priority. Administrators must prioritize the application of the vendor-provided patches listed above to prevent potential service disruption. If patching cannot be performed immediately, ensure that network-level traffic filtering is in place to block unusually large HTTP requests directed at the authentication interface.