CVE-2022-1337: Mattermost Server

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.

Affected products

• Mattermost Mattermost Server: from 5.37.0, before 5.37.9 (fixed in 5.37.9); from 6.2.0, before 6.2.5 (fixed in 6.2.5); from 6.3.0, before 6.3.5 (fixed in 6.3.5); from 6.4.0, before 6.4.2 (fixed in 6.4.2)

Published 2022-04-13. Last modified 2026-06-17.