CVE-2025-14435 - Application-Level DoS via infinite re-render loop in user profile handling

Back Back to CVE browser

MEDIUM

Application-Level DoS via infinite re-render loop in user profile handling

Published Jan 16, 2026

6.8

MEDIUM

CVSS 3.1

EPSS 0.31%

Description

Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
- Version
  10.11.0
  Status
  affected
  Constraints
  <=10.11.8
- Version
  11.0.0
  Status
  affected
  Constraints
  <=11.0.6
- Version
  11.1.0
  Status
  affected
  Constraints
  <=11.1.1
- Version
  10.11.9
  Status
  unaffected
  Constraints
  -
- Version
  11.0.7
  Status
  unaffected
  Constraints
  -
- Version
  11.1.2
  Status
  unaffected
  Constraints
  -
- Version
  11.2.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mattermost

unaffected

Version	Status	Constraints
10.11.0	affected	<=10.11.8
11.0.0	affected	<=11.0.6
11.1.0	affected	<=11.1.1
10.11.9	unaffected	-
11.0.7	unaffected	-
11.1.2	unaffected	-
11.2.0	unaffected	-

github.com/mattermost/mattermost-server

Go

Introduced 11.1.0+incompatible Fixed 11.1.2+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 11.0.1+incompatible Fixed 11.0.7+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 10.11.0+incompatible Fixed 10.11.9+incompatible

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost-server	11.1.0+incompatible	11.1.2+incompatible
Go	github.com/mattermost/mattermost-server	11.0.1+incompatible	11.0.7+incompatible
Go	github.com/mattermost/mattermost-server	10.11.0+incompatible	10.11.9+incompatible

Remediation

Vendor solution

Update Mattermost to versions 11.2.0, 10.11.9, 11.1.2, 11.0.7 or higher.

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (8)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2916		Advisory
https://github.com/advisories/GHSA-mx8m-v8qm-xwr8		Advisory
https://github.com/mattermost/mattermost/commit/613bb616cd62c584a606919e6978688e7b87d81e
https://github.com/mattermost/mattermost/commit/9f7629504bc93f79af8d606329c025a687e143cd
https://github.com/mattermost/mattermost/commit/cc6b77b271324796b72f1e6b82dba85a86462f9f
https://mattermost.com/security-updates		Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-14435
https://pkg.go.dev/vuln/GO-2026-4326