CVE-2022-1337: Resource exhaustion in Mattermost
Summary
CVE-2022-1337: Resource exhaustion in Mattermost. Affects github.com/mattermost/mattermost-server/v6 versions < 6.4.2. Fixed in 6.4.2. How to fix ↓
Also tracked for
- github.com/mattermost/mattermost-server · Go
- mattermost · Bitnami
The same CVE-2022-1337 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mattermost is an open-source messaging platform that enables teams to collaborate and communicate securely. It is written in Go and provides various features such as real-time messaging, file sharing, and integrations with other tools. The vulnerability identified as CVE-2022-1337 affects Mattermost versions 6.4.1 and earlier. This vulnerability allows an authenticated attacker to crash the server by exploiting the image proxy component. The component allocates memory for multiple copies of a proxied image, making it susceptible to resource exhaustion attacks.
Vulnerability Detail
The image proxy component in Mattermost version 6.4.1 and earlier suffers from a resource exhaustion vulnerability. An authenticated attacker can exploit this vulnerability by providing links to very large image files. The server attempts to allocate memory for multiple copies of the proxied image, leading to excessive memory consumption and eventual server crash. This vulnerability poses a moderate risk and can disrupt the availability of the affected Mattermost instance.
How To Fix
Latest published version: v6.7.2 as of 23 Oct 2026
go get github.com/mattermost/mattermost-server/v6@v6.7.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.4.2
This is the first release that contains the fix.
go get github.com/mattermost/mattermost-server/v6@v6.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to Mattermost version 6.4.2 or later.
Conclusion
The resource exhaustion vulnerability in Mattermost version 6.4.1 and earlier can be exploited by an authenticated attacker to crash the server. To mitigate this risk, it is recommended to upgrade to Mattermost version 6.4.2 or later. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/mattermost/mattermost-server/v6 →
FAQ
Mattermost is an open-source messaging platform that facilitates team collaboration and communication.
Mattermost versions 6.4.1 and earlier are impacted by this vulnerability.
An authenticated attacker can exploit this vulnerability by providing links to very large image files, causing resource exhaustion and server crashes.
This vulnerability is considered moderate, as it can disrupt the availability of the affected Mattermost instance.
No, there is no known workaround for this vulnerability. It is crucial to apply the official fix by upgrading to Mattermost version 6.4.2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mattermost/mattermost-server/v6.
