Threats tagged 'ghsa-r3jf-hm7q-qfw5'

MantisBT versions prior to 2.27.2 are vulnerable to a denial-of-service condition caused by a lack of server-side validation on note length. Attackers can submit extremely long notes (tested with over 4.7 million characters) that corrupt the issue activity logs, rendering the entire activity stream unviewable and preventing new notes from displaying. This breaks collaboration on affected issues. The vulnerability is fixed in version 2.27.2.