{"id":"GHSA-9p92-x77w-9fw2","revision":"afb9b4660b4840168cf2ddd1c2561005","records":[{"revision":"afb9b4660b4840168cf2ddd1c2561005","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-9p92-x77w-9fw2","aliases":["CVE-2025-9078","GO-2025-3959"],"title":"Mattermost makes Use of Weak Hash","description":"Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing.","state":0,"publishedAt":"2025-09-15T12:31:25+00:00","modifiedAt":"2025-09-17T17:42:10.713067+00:00","affected":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.8.0"},{"kind":"fixed","version":"10.8.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.5.0"},{"kind":"fixed","version":"10.5.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"9.11.0"},{"kind":"fixed","version":"9.11.18"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.10.0"},{"kind":"fixed","version":"10.10.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.9.0"},{"kind":"fixed","version":"10.9.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"8.0.0-20250718075842-cd87e5c87737"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-9078","https://github.com/mattermost/mattermost/commit/356880c8430b77a4a390c89d5a33f6928188d137","https://github.com/mattermost/mattermost/commit/944ad5cdd9876ef61c78c8275906262a4118755a","https://github.com/mattermost/mattermost/commit/a8a4badc130be101e5bc4b7916bbcd2f966c4b79","https://github.com/mattermost/mattermost/commit/cd87e5c877373f109742aa90a3fa136c14774325","https://github.com/mattermost/mattermost","https://mattermost.com/security-updates"],"sourceUrl":"https://github.com/advisories/GHSA-9p92-x77w-9fw2","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9p92-x77w-9fw2","identifiers":["GHSA-9p92-x77w-9fw2","CVE-2025-9078","GO-2025-3959"]},"retained":false,"historicalAffected":[]}],"coverage":[]}