What is the CVSS score of CVE-2026-2325?

CVE-2026-2325 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-2325?

Yes, a patch is available for CVE-2026-2325. Update the affected software to the latest version immediately.

Mattermost CVE-2026-2325

Q: Which versions of Mattermost are affected by CVE-2026-2325?

Resource exhaustion in Mattermost Server 10.11.x through 11.5.1 allows authenticated users to trigger denial of service by sending oversized HTTP POST requests to the /api/v1/meetings endpoint.. A patch is available.

EUVD-2026-30737 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-18 Mattermost

GHSA-m3p3-8frq-q7qh

Mattermost Denial Of Service

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 08:16 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to {{/api/v1/meetings}}.. Mattermost Advisory ID: MMSA-2026-00608

AnalysisAI

Resource exhaustion in Mattermost Server 10.11.x through 11.5.1 allows authenticated users to trigger denial of service by sending oversized HTTP POST requests to the /api/v1/meetings endpoint. The vulnerability affects three active release branches with no request size validation on the meeting start API. EPSS data not available; no confirmed active exploitation (not in CISA KEV); authentication requirement (PR:L) reduces immediate exposure to internal or compromised users. Vendor advisory MMSA-2026-00608 confirms the issue.

Technical ContextAI

The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling) in Mattermost's meetings API implementation. The /api/v1/meetings endpoint, used to initiate video conferencing or collaboration sessions, lacks input validation on the HTTP request body size. When processing POST requests, the server attempts to allocate memory and processing resources proportional to the incoming payload without enforcing maximum size constraints. This allows arbitrarily large payloads to consume server memory, CPU cycles, and network bandwidth. The affected CPE (cpe:2.3:a:mattermost:mattermost) confirms this is a server-side vulnerability in the core Mattermost application across multiple major version branches (10.11.x, 11.4.x, 11.5.x), indicating the vulnerable code was introduced before version 10.11.0 and persists through current releases.

RemediationAI

Apply vendor-released patches by upgrading to fixed Mattermost versions. Based on the advisory pattern, fixed versions are likely 11.5.2, 10.11.14, and 11.4.4 or later within each branch, though exact patch versions should be confirmed from https://mattermost.com/security-updates before deployment. Organizations unable to immediately patch should implement compensating controls: configure reverse proxy (nginx, HAProxy) or web application firewall to enforce maximum request body size limits (recommend 10-50MB depending on legitimate meeting creation payload requirements) specifically for the /api/v1/meetings endpoint; monitor server resource utilization (memory, CPU) for anomalies indicating oversized request attacks; implement rate limiting on the meetings API endpoint per authenticated user (e.g., 10 requests per minute) to prevent sustained abuse; review authentication logs for suspicious accounts making repeated large POST requests. Note that request size limits may impact legitimate use cases if users need to attach large files during meeting creation, so test limits against normal workflows. Rate limiting may delay legitimate concurrent meeting starts in high-activity environments.