High severity · published Nov 4, 2025
CVE-2025-46556
MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.27.1 and below allow attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters) due to a lack of server-side validation of note length. Once such a note is added, the activity stream UI fails to render; therefore, new notes cannot be displayed, effectively breaking all future collaboration on the issue. This issue is fixed in version 2.27.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mantisbt · mantisbt
< 2.27.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-46556
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-46556
Patch
https://github.com/mantisbt/mantisbt/commit/c99a41272532ba49b5c8dccb7797afead9864234
Patch
https://github.com/mantisbt/mantisbt/commit/d5cec6bffb44d54bd412c186b9baa409b1aa4238
Patch
https://github.com/mantisbt/mantisbt/commit/e9119c68b4a0eaa0bbde3deb121e81f5f7157361
Vendor Advisory
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-r3jf-hm7q-qfw5
More from mantisbt
9.8
CVE-2026-30849
MantisBT SOAP API has an authentication bypass vulnerability on MySQL
9.6
CVE-2019-15074
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings…
9.3
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
9.1
CVE-2025-47776
MantisBT: Authentication bypass for some passwords due to PHP type juggling
8.8
CVE-2017-7615
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php