What is the CVSS score of CVE-2026-21388?

CVE-2026-21388 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-21388?

Yes, a patch is available for CVE-2026-21388. Update the affected software to the latest version immediately.

Mattermost CVE-2026-21388

Q: Which versions of Mattermost are affected by CVE-2026-21388?

Mattermost Plugins versions 2.3.1 and earlier allow unauthenticated remote attackers to trigger denial of service by sending oversized JSON payloads to the /lifecycle webhook endpoint, causing memory…. A patch is available.

EUVD-2026-20880 LOW

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-09 Mattermost

GHSA-x274-8qfc-hrgf

Denial Of Service Mattermost

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 10:30 euvd

EUVD-2026-20880

Analysis Generated

Apr 09, 2026 - 10:30 vuln.today

CVE Published

Apr 09, 2026 - 10:09 nvd

LOW 3.7

DescriptionCVE.org

Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610

AnalysisAI

Mattermost Plugins versions 2.3.1 and earlier allow unauthenticated remote attackers to trigger denial of service by sending oversized JSON payloads to the /lifecycle webhook endpoint, causing memory exhaustion due to missing request body size validation. CVSS 3.7 reflects low severity despite network accessibility; EPSS and active exploitation status not independently confirmed from available data.

Technical ContextAI

The vulnerability exists in the /lifecycle webhook endpoint within Mattermost Plugins, a critical component that processes lifecycle events for plugin management. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that the endpoint fails to enforce restrictions on the size of incoming request payloads. When an attacker sends a crafted JSON request body without size constraints, the server allocates memory to parse and buffer this data, exhausting available heap memory and triggering a denial of service condition. The affected product is identified by CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* for all Mattermost installations running vulnerable Plugins versions.

RemediationAI

Upgrade Mattermost Plugins to a version greater than 2.3.1 to obtain the patch. Exact patched version numbers are not specified in the advisory reference provided; consult https://mattermost.com/security-updates (Mattermost Advisory ID: MMSA-2026-00610) for specific release versions and upgrade procedures. As an interim workaround pending patching, implement network-level rate limiting and request size limits (e.g., via reverse proxy or WAF rules) on the /lifecycle endpoint to reject payloads exceeding a reasonable threshold for legitimate webhook traffic. Additionally, restrict access to the /lifecycle endpoint to trusted sources if operationally feasible.