cve/2024/CVE-2024-2446.md

### [CVE-2024-2446](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2446)
![](https://img.shields.io/static/v1?label=Product&message=Mattermost&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=8.1.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=9.2.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=9.3.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=9.4.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen)

### Description

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages.

### POC

#### Reference
- https://mattermost.com/security-updates

#### Github
No PoCs found on GitHub currently.