Medium
DoS in Mattermost Playbooks via Excessive Task Actions
Type: advisorySources: OSV
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-35965
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:24 UTC · Revision 1
Source evidence
DoS in Mattermost Playbooks via Excessive Task Actions
core-osv · Original sourcePublished 24 Apr 2025, 06:49 UTC
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.
osv:CVE-2025-35965
Complete source record
{
"id": "a2a06ec730b823e0dc3f1d1f98101e9e1847d9790cbf6ec4dadfbff2b6defb68",
"url": "https://osv.dev/vulnerability/CVE-2025-35965",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DoS in Mattermost Playbooks via Excessive Task Actions",
"summary": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.",
"evidence": "osv:CVE-2025-35965",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-35965",
"aliases": [
"CVE-2025-35965",
"GHSA-689c-xq7x-xjwf",
"GO-2025-3643"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mattermost/mattermost",
"type": "GIT",
"events": [
{
"introduced": "0bc2ddd42375a75ab14e63f038165150d4f07659"
},
{
"fixed": "0e03b4f1cc90289ac8fe2520bed0fbf197abd74b"
},
{
"introduced": "7c8c0b7464fa9cd2fbfb97c65d1475b4be2e765c"
},
{
"fixed": "e644e3c8e3931a9432bbd23ff6a219c5664011e9"
},
{
"introduced": "58bd34fd34cbd7d3da777d627b6cffdf8a532930"
},
{
"last_affected": "58bd34fd34cbd7d3da777d627b6cffdf8a532930"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.11.0"
},
{
"fixed": "9.11.11"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.4.0"
},
{
"fixed": "10.4.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:10.5.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "10.5.0-NA"
},
{
"last_affected": "10.5.0-NA"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"10.5.0-NA",
"v9.11.10",
"v9.11.10-rc1",
"v9.11.9",
"v10.4.3-rc3",
"v9.11.9-rc2",
"v10.4.3-rc2",
"v9.11.9-rc1",
"v10.4.3-rc1",
"v10.5.0-rc6",
"v10.5.0",
"@mattermost/types@10.5.0",
"@mattermost/client@10.5.0",
"v9.11.8",
"v10.4.2",
"v9.11.7-rc3",
"v9.11.7",
"v10.4.1",
"v9.11.7-rc2",
"v10.4.0-rc3",
"v10.4.0",
"@mattermost/types@10.4.0",
"@mattermost/client@10.4.0",
"v9.11.7-rc1",
"v9.11.6",
"v9.11.6-rc2",
"v9.11.6-rc1",
"v9.11.5",
"v9.11.5-rc1",
"v9.11.4",
"v9.11.4-rc1",
"v9.11.3",
"v9.11.3-rc2",
"v9.11.3-rc1",
"v9.11.2",
"v9.11.2-rc2",
"v9.11.2-rc1",
"v9.11.1-rc1",
"v9.11.1",
"v9.11.0-rc3",
"v9.11.0",
"@mattermost/types@9.11.0",
"@mattermost/client@9.11.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-35965.json"
}
}
],
"modified": "2026-10-28T02:30:23.373151824Z",
"provider": "osv",
"references": [
"https://mattermost.com/security-updates",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/35xxx/CVE-2025-35965.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-35965"
],
"provider_metadata": {
"cwe_ids": [
"CWE-770"
],
"cna_assigner": "Mattermost",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "10.5.0"
},
{
"last_affected": "10.5.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "10.4.0"
},
{
"last_affected": "10.4.2"
},
{
"introduced": "9.11.0"
},
{
"last_affected": "9.11.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/35xxx/CVE-2025-35965.json"
}
},
"related_cves": [
{
"value": "CVE-2025-35965",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489809,
"published_at": "2025-04-24T06:49:22.669+00:00"
}