CVE-2024-24988: Excessive resource consumption when sending long emoji names in user custom status
Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24988?
CVE-2024-24988 is considered a medium severity vulnerability due to its potential to cause high resource consumption and possibly crash the server.
How do I fix CVE-2024-24988?
To mitigate CVE-2024-24988, upgrade Mattermost to version 8.1.9, 9.2.5, or 9.3.1, as these versions address the vulnerability.
What types of attacks are possible with CVE-2024-24988?
CVE-2024-24988 allows attackers to send excessively long strings as emoji values which can lead to resource exhaustion.
Which versions of Mattermost are affected by CVE-2024-24988?
CVE-2024-24988 affects Mattermost versions prior to 8.1.9, between 9.0.0 and 9.1.5, and between 9.2.0 and 9.2.4.
Is there a workaround available for CVE-2024-24988?
There are no official workarounds for CVE-2024-24988; the recommended action is to upgrade to a fixed version.