Executive brief
A vulnerability in the Mattermost Desktop application allows a malicious server owner to crash a user's app. By forcing the application to open an excessively long web link, the software becomes overwhelmed and stops responding. This can lead to a denial of service, disrupting communication and business operations for affected users.
Technical details
The Mattermost Desktop App fails to properly throttle or limit the length of URLs passed to the window.open function, leading to an 'Allocation of Resources Without Limits or Throttling' (CWE-770) condition. A malicious server owner can exploit this by including a script that calls window.open with an exceptionally large URL string. This results in an application crash (Denial of Service). The attack requires user interaction to connect to or interact with the malicious server but does not require special privileges. The issue is addressed in Mattermost's security updates.
Affected products
- Mattermost Desktop App <= 6.1, 5.5.13.0
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory