What is the CVSS score of CVE-2026-21388?

CVE-2026-21388 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-21388?

Yes, a patch is available for CVE-2026-21388. Update the affected software to the latest version immediately.

Mattermost CVE-2026-21388

Q: Which versions of Mattermost are affected by CVE-2026-21388?

Mattermost Plugins versions 2.3.1 and earlier allow unauthenticated remote attackers to trigger denial of service by sending oversized JSON payloads to the /lifecycle webhook endpoint, causing memory…. A patch is available.

EUVD-2026-20880 LOW

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-09 Mattermost

GHSA-x274-8qfc-hrgf

Denial Of Service Mattermost

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 10:30 euvd

EUVD-2026-20880

Analysis Generated

Apr 09, 2026 - 10:30 vuln.today

CVE Published

Apr 09, 2026 - 10:09 nvd

LOW 3.7

DescriptionCVE.org

Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610

AnalysisAI

Mattermost Plugins versions 2.3.1 and earlier allow unauthenticated remote attackers to trigger denial of service by sending oversized JSON payloads to the /lifecycle webhook endpoint, causing memory exhaustion due to missing request body size validation. CVSS 3.7 reflects low severity despite network accessibility; EPSS and active exploitation status not independently confirmed from available data.

Technical ContextAI

The vulnerability exists in the /lifecycle webhook endpoint within Mattermost Plugins, a critical component that processes lifecycle events for plugin management. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that the endpoint fails to enforce restrictions on the size of incoming request payloads. When an attacker sends a crafted JSON request body without size constraints, the server allocates memory to parse and buffer this data, exhausting available heap memory and triggering a denial of service condition. The affected product is identified by CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* for all Mattermost installations running vulnerable Plugins versions.

RemediationAI

Upgrade Mattermost Plugins to a version greater than 2.3.1 to obtain the patch. Exact patched version numbers are not specified in the advisory reference provided; consult https://mattermost.com/security-updates (Mattermost Advisory ID: MMSA-2026-00610) for specific release versions and upgrade procedures. As an interim workaround pending patching, implement network-level rate limiting and request size limits (e.g., via reverse proxy or WAF rules) on the /lifecycle endpoint to reject payloads exceeding a reasonable threshold for legitimate webhook traffic. Additionally, restrict access to the /lifecycle endpoint to trusted sources if operationally feasible.