Medium
Security advisory
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-4182
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 16:10 UTC · Revision 1
Source evidence
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.
osv:CVE-2024-4182
Complete source record
{
"id": "33b8ed43f21ff482e0beb3efc13e35b50667f85a1be538d65264ece5d3d11780",
"url": "https://osv.dev/vulnerability/CVE-2024-4182",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2024-4182",
"summary": "Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.",
"evidence": "osv:CVE-2024-4182",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-4182",
"aliases": [
"CVE-2024-4182",
"GHSA-8f99-g2pj-x8w3",
"GO-2024-2795"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mattermost/mattermost",
"type": "GIT",
"events": [
{
"introduced": "096c9ea12a2144f832e330e9a0f4d3862ca20b9f"
},
{
"fixed": "c91d188755c63cc41237105b5f871a341e5faafd"
},
{
"introduced": "baa88a2450d49dfea42990861283b5ed9d469edf"
},
{
"fixed": "86920d641760552c5aafa5e1d14c93bd30039bc4"
},
{
"introduced": "99d819d25d0b16b3faed901b1fe5c41de7655e9c"
},
{
"fixed": "baf02ba4e27d641a53785ab0c6bc9a9870b237a6"
},
{
"introduced": "9fc0f464a376499ca5859944483f09a32370a85a"
},
{
"fixed": "13049d8b16b195f98246dff4812b5f64c1e5a627"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.1.0"
},
{
"fixed": "8.1.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.4.0"
},
{
"fixed": "9.4.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.5.0"
},
{
"fixed": "9.5.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.6.0"
},
{
"fixed": "9.6.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v8.1.12-rc3",
"v9.5.3-rc3",
"v8.1.12-rc2",
"v9.5.3-rc2",
"v9.6.1-rc2",
"v8.1.12-rc1",
"v9.4.5-rc1",
"v9.5.3-rc1",
"v9.6.1-rc1",
"v9.4.4-rc1",
"v9.4.4",
"v8.1.11-rc1",
"v8.1.11",
"v9.5.2",
"v9.6.0-rc3",
"v9.6.0",
"@mattermost/types@9.6.0",
"@mattermost/client@9.6.0",
"v8.1.10-rc1",
"v8.1.10",
"v9.4.3-rc1",
"v9.4.3",
"v9.5.1-rc1",
"v9.5.1",
"v9.5.0-rc3",
"v9.5.0",
"@mattermost/types@9.5.0",
"@mattermost/client@9.5.0",
"v8.1.9",
"v8.1.9-rc2",
"v9.4.2-rc2",
"v9.4.2",
"v8.1.9-rc1",
"v9.4.2-rc1",
"v8.1.8",
"v9.4.1",
"v9.4.0-rc4",
"v9.4.0",
"@mattermost/types@9.4.0",
"@mattermost/client@9.4.0",
"v8.1.8-rc2",
"v8.1.8-rc1",
"v8.1.7-rc3",
"v8.1.7",
"v8.1.7-rc2",
"v8.1.7-rc1",
"v8.1.6-rc1",
"v8.1.6",
"v8.1.5-rc2",
"v8.1.5",
"v8.1.5-rc1",
"v8.1.4-rc2",
"v8.1.4",
"v8.1.4-rc1",
"v8.1.3-rc2",
"v8.1.3",
"v8.1.3-rc1",
"v8.1.2-rc2",
"v8.1.2",
"v8.1.2-rc1",
"v8.1.1-rc2",
"v8.1.1",
"@mattermost/types@8.1.1",
"@mattermost/client@8.1.1",
"v8.1.1-rc1",
"v8.1.0-rc2",
"v8.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4182.json"
}
}
],
"modified": "2026-10-28T02:30:20.673501549Z",
"provider": "osv",
"references": [
"https://mattermost.com/security-updates",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4182.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-4182"
],
"provider_metadata": {
"cwe_ids": [
"CWE-754"
],
"cna_assigner": "Mattermost",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "9.6.0"
},
{
"last_affected": "9.6.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "9.5.0"
},
{
"last_affected": "9.5.2"
},
{
"introduced": "9.4.0"
},
{
"last_affected": "9.4.4"
},
{
"introduced": "8.1.0"
},
{
"last_affected": "8.1.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4182.json"
}
},
"related_cves": [
{
"value": "CVE-2024-4182",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 486961,
"published_at": "2024-04-26T08:25:37.093+00:00"
}