CVE-2025-46556: MantisBT Denial of Service Vulnerability

CVE-2025-46556 Overview

CVE-2025-46556 is a high-severity input validation vulnerability affecting Mantis Bug Tracker (MantisBT), a widely-used open source issue tracking system. The vulnerability allows attackers to permanently corrupt issue activity logs by submitting extremely long notes due to missing server-side validation of note length. This flaw enables denial of service conditions that can disrupt organizational workflows relying on MantisBT for bug tracking and collaboration.

Critical Impact

Attackers can permanently break issue collaboration by submitting oversized notes (tested with 4,788,761 characters), causing the activity stream UI to fail rendering and preventing all future note display on affected issues.

Affected Products

• MantisBT versions 2.27.1 and below
• All MantisBT installations lacking server-side input validation for note fields

Discovery Timeline

• 2025-11-04 - CVE-2025-46556 published to NVD
• 2025-11-07 - Last updated in NVD database

Technical Details for CVE-2025-46556

Vulnerability Analysis

This vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling). MantisBT versions 2.27.1 and earlier fail to implement server-side validation for the length of note submissions in bug reports and activity streams. An attacker can exploit this by submitting notes with an extremely large character count—testing confirmed successful exploitation with notes containing nearly 4.8 million characters.

When such an oversized note is stored in the database and the activity stream attempts to render it, the UI component fails catastrophically. This failure is persistent; once a corrupted note exists, the activity stream for that issue becomes permanently non-functional, preventing any future notes from being displayed regardless of their size.

Root Cause

The root cause is the absence of server-side input length validation for textarea fields handling bug notes and descriptions. While client-side constraints may exist, the server accepted arbitrarily large payloads without enforcing limits, allowing malicious data to be persisted to the database. The application lacked proper resource allocation controls as defined by CWE-770, enabling resource exhaustion through oversized input.

Attack Vector

The attack is network-based and requires no authentication in scenarios where anonymous note submission is permitted, or low-privilege access for authenticated instances. An attacker simply submits a POST request to the note submission endpoint with an extremely long string in the bugnote_text parameter. The oversized data is accepted, stored, and subsequently corrupts the issue's activity stream rendering.

The patches introduced by MantisBT implement maxlength attributes on textarea elements and enforce max_textarea_length configuration limits server-side:

// Patch example from bug_actiongroup_add_note_inc.php
// Source: https://github.com/mantisbt/mantisbt/commit/d5cec6bffb44d54bd412c186b9baa409b1aa4238

			<?php echo lang_get( 'add_bugnote_title' ); ?>
		</th>
		<td>
-			<textarea class="form-control" name="bugnote_text" id="bugnote_text" cols="80" rows="10"></textarea>
+			<textarea class="form-control" name="bugnote_text" id="bugnote_text"
+					  cols="80" rows="10" maxlength="<?php echo DB_FIELD_SIZE_LONGTEXT ?>"
+			></textarea>
		</td>
	</tr>

// Patch example from bug_update_page.php
// Source: https://github.com/mantisbt/mantisbt/commit/c99a41272532ba49b5c8dccb7797afead9864234

 $t_bug_id = $f_bug_id;
 
 $t_action_button_position = config_get( 'action_button_position' );
+$t_max_textarea_length = config_get_global( 'max_textarea_length' );
 
 $t_top_buttons_enabled = $t_action_button_position == POSITION_TOP || $t_action_button_position == POSITION_BOTH;
 $t_bottom_buttons_enabled = $t_action_button_position == POSITION_BOTTOM || $t_action_button_position == POSITION_BOTH;

Detection Methods for CVE-2025-46556

Indicators of Compromise

• HTTP POST requests to MantisBT note submission endpoints (/bug_update.php, /bugnote_add.php) with unusually large Content-Length headers (exceeding 1MB)
• Database entries in the mantis_bugnote_text_table with text content exceeding expected limits
• User reports of activity streams failing to load for specific issues
• Web server logs showing exceptionally long response times or memory exhaustion during note submission processing

Detection Strategies

• Implement web application firewall (WAF) rules to block POST requests with body sizes exceeding reasonable thresholds for note submissions
• Monitor database table sizes and row lengths for anomalous entries in note-related tables
• Configure application performance monitoring to alert on rendering failures in the activity stream component
• Review access logs for repeated large POST submissions from single IP addresses

Monitoring Recommendations

• Set up alerts for HTTP 500 errors on MantisBT issue view pages that may indicate UI rendering failures
• Monitor server resource utilization (memory, CPU) during MantisBT request processing for anomalous spikes
• Implement database query monitoring to detect queries returning unusually large result sets from note tables

How to Mitigate CVE-2025-46556

Immediate Actions Required

• Upgrade MantisBT to version 2.27.2 or later immediately
• Review existing database entries for oversized notes that may have been inserted prior to patching
• Implement input validation at the web server or reverse proxy level as an additional defense layer
• Audit note submission logs for evidence of exploitation attempts

Patch Information

MantisBT has released version 2.27.2 which addresses this vulnerability through multiple commits implementing server-side input validation. The patches add maxlength attributes to textarea elements and enforce the max_textarea_length configuration parameter across all note submission forms.

Key commits addressing this vulnerability:

• GitHub Commit c99a41272532 - Limits size of bug text fields
• GitHub Commit d5cec6bffb44 - Limits size of bugnote text fields
• GitHub Commit e9119c68b4a0 - Restricts size of profile textarea fields

For full details, see the GitHub Security Advisory GHSA-r3jf-hm7q-qfw5.

Workarounds

• Configure web server request body size limits to reject oversized POST requests before they reach MantisBT
• Implement WAF rules to validate and truncate input fields at the network perimeter
• Restrict anonymous note submission and require authentication to reduce the attack surface
• Manually add maxlength attributes to textarea elements in affected templates if immediate upgrade is not possible

# Example nginx configuration to limit request body size
# Add to nginx server block for MantisBT

# Limit POST body size to 1MB for MantisBT endpoints
location /mantisbt/ {
    client_max_body_size 1m;
    # Additional MantisBT configuration
}