CVE-2024-4183

—

CVSS 3.1

6.5 medium

EPSS

<1%p47

Published

Apr 26, 2024 (Apr 26, 2024)

Modified

Jun 17, 2026

Description

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.

Vendors: mattermost
Products: mattermost server
Weakness: CWE-400, CWE-770
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.