GitHub Advisoryadvisory · Packagist

GHSA-r3jf-hm7q-qfw5 MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length

MEDIUM Published 2025-11-03 Modified 2025-11-04 Official page ↗
Aliases
CVE-2025-46556
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2025-11-03

Affected packages

• Packagist mantisbt/mantisbt: < 2.27.2 → fixed in 2.27.2

Description

A lack of server-side validation for note length in MantisBT allows attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters). Once such a note is added: Impact • The entire activity stream becomes unviewable (UI fails to render). • New notes cannot be displayed, effectively breaking all future collaboration on the issue. Patches Fixed in 2.27.2. Workarounds None Credits Thanks to Mazen Mahmoud (@TheAmazeng) for reporting the vulnerability.

Related

Alias · CVE (1)

  • CVE-2025-46556 Mantis Bug Tracker (MantisBT) is an open source issue tracker. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References