CVE-2025-46556: MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length
A lack of server-side validation for note length in MantisBT allows attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters). Once such a note is added:
Impact - The entire activity stream becomes unviewable (UI fails to render). - New notes cannot be displayed, effectively breaking all future collaboration on the issue.
Patches Fixed in 2.27.2.
Workarounds None
Credits Thanks to Mazen Mahmoud (@TheAmazeng) for reporting the vulnerability.
Other sources
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.27.1 and below allow attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters) due to a lack of server-side validation of note length. Once such a note is added, the activity stream UI fails to render; therefore, new notes cannot be displayed, effectively breaking all future collaboration on the issue. This issue is fixed in version 2.27.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46556?
The severity of CVE-2025-46556 is critical due to the impact on issue activity logs becoming unviewable.
How do I fix CVE-2025-46556?
To fix CVE-2025-46556, upgrade to MantisBT version 2.27.2 or later, which includes server-side validation for note length.
What are the potential impacts of CVE-2025-46556?
The potential impacts of CVE-2025-46556 include permanently corrupting issue activity logs, making the entire activity stream unviewable.
Is CVE-2025-46556 specific to a certain version of MantisBT?
Yes, CVE-2025-46556 affects versions of MantisBT before 2.27.2.
Can CVE-2025-46556 be exploited without authentication?
Yes, CVE-2025-46556 can potentially be exploited by unauthenticated users if proper input validation is not implemented.