What is the CVSS score of CVE-2026-2454?

CVE-2026-2454 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Mattermost are affected by CVE-2026-2454?

CVE-2026-2454 presents moderate security risk rated CVSS 5.8. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-2454?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mattermost CVE-2026-2454

MEDIUM

Improper Validation of Specified Type of Input (CWE-1287)

2026-03-16 Mattermost

Denial Of Service Mattermost

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 16, 2026 - 20:38 vuln.today

CVE Published

Mar 16, 2026 - 20:10 nvd

MEDIUM 5.8

DescriptionCVE.org

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages to calls plugin. Mattermost Advisory ID: MMSA-2025-00537

AnalysisAI

Mattermost versions 11.3.0 and earlier, 11.2.2 and earlier, and 10.11.10 and earlier contain an array length handling vulnerability in the calls plugin that allows unauthenticated remote attackers to trigger out-of-memory (OOM) errors and crash the server by sending maliciously crafted msgpack frames over websocket connections. With a CVSS score of 5.8 and network-based attack vector requiring no privileges or user interaction, this denial-of-service vulnerability poses a moderate but easily exploitable availability risk to any exposed Mattermost deployment.

Technical ContextAI

The vulnerability resides in Mattermost's calls plugin websocket message handling, specifically in the msgpack deserialization logic. Msgpack is a binary serialization format commonly used for efficient data transmission in real-time communication systems. The affected code fails to properly validate array length fields reported in msgpack frames, allowing an attacker to craft frames that declare larger array sizes than actually present in the payload. When the application attempts to allocate memory based on the declared (but false) array length before validating actual data availability, it can trigger excessive memory allocation leading to out-of-memory conditions (CWE-1287: Improper Neutralization of Special Elements used in an Expression Language Statement). The CPE (cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*) confirms this affects the core Mattermost product across multiple version branches, specifically impacting the websocket-based real-time communications infrastructure used by the calls feature.

RemediationAI

Immediately upgrade affected Mattermost instances to patched versions: upgrade 10.11.x deployments to 10.11.11 or later, upgrade 11.2.x deployments to 11.2.3 or later, and upgrade 11.3.x deployments to 11.3.1 or later. Consult the official Mattermost security advisory at https://mattermost.com/security-updates for version availability and upgrade procedures specific to your deployment method. As an interim mitigation pending patching, implement network-level access controls to restrict websocket connections to the Mattermost server to trusted internal networks only, disable the calls plugin if not actively used, and monitor websocket frame patterns for anomalously large declared array sizes which may indicate exploitation attempts. Additionally, maintain adequate monitoring and alerting on server memory usage to detect potential attack activity, and ensure backups are current to enable rapid recovery if an attack succeeds.