Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin

The vulnerability in Mattermost Confluence Plugin versions before 1.5.0 arises from improper handling of unexpected request bodies. When the create channel subscription endpoint receives an invalid request body, the plugin fails to process it correctly, leading to a crash. This issue is documented in the NVD description [1].

An attacker can exploit this by sending constant, malformed requests to the create channel subscription endpoint. No authentication is explicitly required, and the attacker only needs network access to the Mattermost server running the plugin. The constant hits cause the plugin to repeatedly crash, making it unavailable [1].

The impact is a denial-of-service (DoS) of the plugin, preventing Confluence event notifications from being delivered to Mattermost channels. This disrupts workflow integration and collaboration. The latest plugin version is available on GitHub [2], and security updates are listed on Mattermost's security page [3].

Mitigation requires upgrading to version 1.5.0 or later. Users should follow the update instructions in the plugin repository [2]. No workarounds are mentioned in the available sources.