Medium
Security advisory
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-1953
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 19:33 UTC · Revision 1
Source evidence
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.
osv:CVE-2024-1953
Complete source record
{
"id": "b2f0aa58cfe399abcaf5373dc3750d61a492d80b0f12a4c53fef92b94e7751f7",
"url": "https://osv.dev/vulnerability/CVE-2024-1953",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2024-1953",
"summary": "Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.",
"evidence": "osv:CVE-2024-1953",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-1953",
"aliases": [
"BIT-mattermost-2024-1953",
"CVE-2024-1953",
"GHSA-vm9m-57jr-4pxh",
"GO-2024-2594"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mattermost/mattermost",
"type": "GIT",
"events": [
{
"introduced": "096c9ea12a2144f832e330e9a0f4d3862ca20b9f"
},
{
"fixed": "4c83724516242843802cc75840b08ead6afbd37b"
},
{
"introduced": "b47be1c0f5787562ddf430dd5c5b8b3c35748b06"
},
{
"fixed": "cf3252f5bf7a8ecd29403c873b05c70c3b20e920"
},
{
"introduced": "baa88a2450d49dfea42990861283b5ed9d469edf"
},
{
"fixed": "f344590398e35c6373957fb3b4f761b9acfd82b2"
},
{
"introduced": "7bf5dcb8fb7f05db9a7a6a9be608ac0fe1405351"
},
{
"last_affected": "7bf5dcb8fb7f05db9a7a6a9be608ac0fe1405351"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.1.0"
},
{
"fixed": "8.1.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.2.0"
},
{
"fixed": "9.2.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.4.0"
},
{
"fixed": "9.4.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:9.3.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.0"
},
{
"last_affected": "9.3.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"9.3.0",
"v9.2.5-rc2",
"v8.1.9-rc2",
"v8.1.9-rc1",
"v9.2.5-rc1",
"v9.4.2-rc1",
"v8.1.8",
"v9.2.4",
"v9.4.1",
"v9.4.0-rc4",
"v9.4.0",
"@mattermost/types@9.4.0",
"@mattermost/client@9.4.0",
"v8.1.8-rc2",
"v9.2.4-rc1",
"v8.1.8-rc1",
"v9.3.0-rc2",
"v9.3.0",
"v8.1.7-rc3",
"v8.1.7",
"v8.1.7-rc2",
"v9.2.3-rc1",
"v9.2.3",
"v8.1.7-rc1",
"v8.1.6-rc1",
"v8.1.6",
"v9.2.2",
"v8.1.5-rc2",
"v8.1.5",
"v8.1.5-rc1",
"v9.2.1",
"v9.2.0-rc2",
"v9.2.0",
"@mattermost/types@9.2.0",
"@mattermost/client@9.2.0",
"v8.1.4-rc2",
"v8.1.4",
"v8.1.4-rc1",
"v8.1.3-rc2",
"v8.1.3",
"v8.1.3-rc1",
"v8.1.2-rc2",
"v8.1.2",
"v8.1.2-rc1",
"v8.1.1-rc2",
"v8.1.1",
"@mattermost/types@8.1.1",
"@mattermost/client@8.1.1",
"v8.1.1-rc1",
"v8.1.0-rc2",
"v8.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1953.json"
}
}
],
"modified": "2026-10-28T02:30:22.663620480Z",
"provider": "osv",
"references": [
"https://mattermost.com/security-updates",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1953.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-1953"
],
"provider_metadata": {
"cwe_ids": [
"CWE-400"
],
"cna_assigner": "Mattermost",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "9.3.0"
},
{
"last_affected": "9.3.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "9.4.0"
},
{
"last_affected": "9.4.1"
},
{
"introduced": "9.2.0"
},
{
"last_affected": "9.2.4"
},
{
"introduced": "8.1.0"
},
{
"last_affected": "8.1.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1953.json"
}
},
"related_cves": [
{
"value": "CVE-2024-1953",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489218,
"published_at": "2024-02-29T10:42:41.576+00:00"
}