Dependency Vulnerability Analysis¶

This document provides context on why certain third-party dependencies in Mattermost, although flagged as vulnerable by security scanners, do not pose a risk in Mattermost deployments.

This analysis is regularly updated as new vulnerability reports are received and evaluated.

Overview¶

Mattermost regularly scans its dependencies for known vulnerabilities. Some dependencies may be flagged as vulnerable by security scanners, but these vulnerabilities might not be applicable to Mattermost due to:

How the dependency is used in Mattermost
The specific version or configuration implemented
Mitigations already in place
False positives in the scanning process

Dependency Analysis Table¶

Below is a list of dependencies flagged as vulnerable by security scanners, along with the justification for why each issue is not relevant to Mattermost deployments:

Dependency / Version	Vulnerability	False Positive Justification
github.com/mholt/archiver/v3 v3.5.1	GHSA-rhh4-rh7c-7r5v CVE-2024-0406	Mattermost doesn’t use the vulnerable `Unarchive()` function.
github.com/mholt/archiver/v3 v3.5.1	GHSA-7vpp-9cxj-q8g CVE-2025-3445	Mattermost doesn’t use the vulnerable `Unarchive()` function.
github.com/redis/go-redis/v9 v9.7.0	GHSA-92cp-5422-2mw7 CVE-2025-29923	Mattermost doesn’t use this transitive dependency.
github.com/blevesearch/bleve/v2 v2.4.4-0.20250115090822-cbafdca08538	GHSA-9w9f-6mg8-jp7w CVE-2022-31022	Mattermost doesn’t use the vulnerable `bleve/http` package.
golang stdlib v1.23.7	CVE-2025-22871	Mattermost doesn’t use the vulnerable functions `chunkedReader.Read` and `readChunkLine`.