EUVD-2026-30737
GHSA-m3p3-8frq-q7qh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to {{/api/v1/meetings}}.. Mattermost Advisory ID: MMSA-2026-00608
AnalysisAI
Resource exhaustion in Mattermost Server 10.11.x through 11.5.1 allows authenticated users to trigger denial of service by sending oversized HTTP POST requests to the /api/v1/meetings endpoint. The vulnerability affects three active release branches with no request size validation on the meeting start API. EPSS data not available; no confirmed active exploitation (not in CISA KEV); authentication requirement (PR:L) reduces immediate exposure to internal or compromised users. Vendor advisory MMSA-2026-00608 confirms the issue.
Technical ContextAI
The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling) in Mattermost's meetings API implementation. The /api/v1/meetings endpoint, used to initiate video conferencing or collaboration sessions, lacks input validation on the HTTP request body size. When processing POST requests, the server attempts to allocate memory and processing resources proportional to the incoming payload without enforcing maximum size constraints. This allows arbitrarily large payloads to consume server memory, CPU cycles, and network bandwidth. The affected CPE (cpe:2.3:a:mattermost:mattermost) confirms this is a server-side vulnerability in the core Mattermost application across multiple major version branches (10.11.x, 11.4.x, 11.5.x), indicating the vulnerable code was introduced before version 10.11.0 and persists through current releases.
RemediationAI
Apply vendor-released patches by upgrading to fixed Mattermost versions. Based on the advisory pattern, fixed versions are likely 11.5.2, 10.11.14, and 11.4.4 or later within each branch, though exact patch versions should be confirmed from https://mattermost.com/security-updates before deployment. Organizations unable to immediately patch should implement compensating controls: configure reverse proxy (nginx, HAProxy) or web application firewall to enforce maximum request body size limits (recommend 10-50MB depending on legitimate meeting creation payload requirements) specifically for the /api/v1/meetings endpoint; monitor server resource utilization (memory, CPU) for anomalies indicating oversized request attacks; implement rate limiting on the meetings API endpoint per authenticated user (e.g., 10 requests per minute) to prevent sustained abuse; review authentication logs for suspicious accounts making repeated large POST requests. Note that request size limits may impact legitimate use cases if users need to attach large files during meeting creation, so test limits against normal workflows. Rate limiting may delay legitimate concurrent meeting starts in high-activity environments.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today