docs/main/security-guide/dependency-vulnerability-analysis.mdx
This document provides context on why certain third-party dependencies in Mattermost, although flagged as vulnerable by security scanners, do not pose a risk in Mattermost deployments.
This analysis is regularly updated as new vulnerability reports are received and evaluated.
Mattermost regularly scans its dependencies for known vulnerabilities. Some dependencies may be flagged as vulnerable by security scanners, but these vulnerabilities might not be applicable to Mattermost due to:
Below is a list of dependencies flagged as vulnerable by security scanners for our latest release, along with the justification for why each issue is not relevant to Mattermost deployments:
<table> <colgroup> <col style={{width: '25%'}} /> <col style={{width: '25%'}} /> <col style={{width: '50%'}} /> </colgroup> <thead> <tr> <th>Dependency / Version</th> <th>Vulnerability</th> <th>False Positive Justification</th> </tr> </thead> <tbody> <tr> <td>github.com/mattermost/ mattermost/server/v8</td> <td>Multiple CVE IDs</td> <td>Mattermost uses Go module workspaces, which override go.mod dependency versions with local filesystem code at build time. The vulnerable versions are never included in final Docker images.</td> </tr> <tr> <td>golang.org/x/crypto v0.44.0</td> <td>GHSA-f6x5-jh6r-wrfv CVE-2025-47914</td> <td>Mattermost doesn't utilize the vulnerable golang.org/x/crypto/ssh package. Upgrade is planned for v11.4</td> </tr> <tr> <td>golang.org/x/crypto v0.44.0</td> <td>GGHSA-j5w8-q4qc-rx2x CVE-2025-58181</td> <td>Mattermost doesn't utilize the vulnerable golang.org/x/crypto/ssh package. Upgrade is planned for v11.4</td> </tr> </tbody> </table>