Mattermost is vulnerable to CPU exhaustion via crafted HTTP request

Mattermost versions 10.11.x = 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens...

CVE-2025-14822 DoS from quadratic complexity in model.ParseHashtags

Mattermost versions 10.11.x = 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens...

CVE-2025-14822

Mattermost versions 10.11.x = 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens...

CVE-2025-14822

Mattermost contains a vulnerability (CVE-2025-14822) affecting versions 10.11.x up to 10.11.8 where input size is not validated before processing hashtags. An authenticated attacker can exhaust CPU resources with a single HTTP POST containing thousands of space-separated tokens in a post, leading...

CVE-2025-14822 DoS from quadratic complexity in model.ParseHashtags

Mattermost versions 10.11.x = 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens...

EUVD-2026-2917

Mattermost versions 10.11.x = 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens...

SUSE CVE-2025-71142

In the Linux kernel, the following vulnerability has been resolved: cpuset: fix warning when disabling remote partition A warning was triggered as follows: WARNING: kernel/cgroup/cpuset.c:1651 at remotepartitiondisable+0xf7/0x110 RIP: 0010:remotepartitiondisable+0xf7/0x110 RSP:...

PT-2026-3241

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.8 Description Mattermost versions 10.11.x up to and including 10.11.8 do not properly validate the size of input before processing hashtags. This allows an authenticated attacker to consume excessive C...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004442)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004442 advisory. In iondmabufendcpuaccess and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004341)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004341 advisory. kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfsquotaus is used e.g., with Kubernetes, allows attackers to cause a denial of service against...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000556)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000556 advisory. KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003915)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003915 advisory. kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfsquotaus is used e.g., with Kubernetes, allows attackers to cause a denial of service against...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001216)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001216 advisory. The perfcputimemaxpercenthandler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service integer overflow or...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001010)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001010 advisory. Array index error in the kvmvmioctlcreatevcpu function in virt/kvm/kvmmain.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain...

MiracleLinux 4 : openssl-1.0.1e-16.AXS4.4 (AXSA:2014-071:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-071:01 advisory. The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries...

MiracleLinux 7 : [security - medium] qt5 (AXSA:2019-4200:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4200:01 advisory. qt5-qtbase: Double free in QXmlStreamReader CVE-2018-15518 qt5-qtsvg: Invalid parsing of malformed url reference resulting in a denial of service...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004257)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004257 advisory. An issue was discovered in the Linux kernel before 5.6. svmcpuuninit in arch/x86/kvm/svm.c has a memory leak, aka CID-d80b64ff297e. NOTE: third parties dispute this...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000644)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000644 advisory. arch/arm/kvm/arm.c in the Linux kernel before 3.10 on the ARM platform, when KVM is used, allows host OS users to cause a denial of service NULL pointer dereference,...

CVE-2026-21911

An Incorrect Calculation vulnerability in the Layer 2 Control Protocol Daemon l2cpd of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker flapping the management interface to cause the learning of new MACs over label-switched interfaces LSI to stop while...

CVE-2026-21911

An Incorrect Calculation vulnerability in the Layer 2 Control Protocol Daemon l2cpd of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker flapping the management interface to cause the learning of new MACs over label-switched interfaces LSI to stop while...