Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2025-14822 is a low-severity Inefficient Algorithmic Complexity (CWE-407) vulnerability in Mattermost Mattermost Server. Its CVSS base score is 3.1 (Low).
Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2917
Vulnerability Data
Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of input size and format before processing, which would reject the oversized hashtag token list that triggers CPU exhaustion.
Mandates safeguards that limit the effects of DoS attacks caused by resource exhaustion from a single malicious request.
Requires protection of system resources against exhaustion, mitigating the CPU impact from unvalidated large inputs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Monitoring capacity and taking action to maintain availability directly reduces unchecked resource allocation.
Secure SDLC practices (code review, complexity analysis, safe algorithm selection) prevent introduction of exploitable worst-case behavior.
Runtime monitoring of software and resources can detect the performance impact of triggered worst-case complexity.
Identifying and recording algorithmic-complexity vulnerabilities directly addresses the root cause before exploitation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Baseline comparison of CPU, memory and bandwidth usage helps surface uncontrolled resource allocations before they cause service degradation.
Security testing can uncover performance issues stemming from algorithmic complexity.
Capacity projections and elasticity measures ensure that allocation requests are bounded and can be throttled, reducing the window in which an attacker can force unbounded resource reservations.
Defining retention periods and deletion schedules for backup copies prevents indefinite accumulation of data on storage media without corresponding resource-management controls.
Redundancy of processing facilities can absorb resource exhaustion from inefficient algorithms.
Secure development life cycle includes design reviews that can catch inefficient algorithms before deployment.