Mattermost Desktop App versions up to 6.1 or 5.5.13.0 treat URLs that exceed internal limits as valid, allowing a script that executes Window.open on an excessively long URL to be delivered from a malicious server. The oversized URL causes the app to crash, creating a denial‑of‑service condition for the affected user. This weakness is identified as CWE‑770 – Excessive Resource Consumption.

The vulnerability exists in Mattermost’s Desktop App for Windows, macOS, and Linux. Versions 6.1 and earlier, including 5.5.13.0, are affected. Users who run these versions on client machines with network access to an attacker‑controlled server are at risk.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is below 1 %, suggesting that exploitation is uncommon. The vulnerability is not included in CISA’s KEV list. The attack requires the user to open a malicious link or visit a site that serves the oversized URL; therefore, the vector is network‑based and user interaction is needed. While the risk is moderate, the impact of an application crash can be disruptive for teams relying on Mattermost for daily communication.