EUVD-2026-12383
GHSA-34g8-9fpp-46ch
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button.. Mattermost Advisory ID: MMSA-2026-00571
AnalysisAI
Mattermost fails to enforce response size limits on integration action endpoints, allowing an authenticated attacker to trigger server memory exhaustion and denial of service by clicking an interactive message button that connects to a malicious integration server returning arbitrarily large responses. This vulnerability affects Mattermost versions 11.3.0, 11.2.x up to 11.2.2, and 10.11.x up to 10.11.10. While the CVSS score of 5.3 is moderate, the attack requires user interaction (UI:R) and network access, but can be reliably triggered by any authenticated user interacting with crafted messages.
Technical ContextAI
The vulnerability exists in Mattermost's integration framework, specifically in how action endpoints handle HTTP responses from third-party integration servers. Mattermost (CPE:2.3:a:mattermost:mattermost) lacks input validation and response size constraints when processing replies from integration action endpoints, violating the principle of resource management. This directly relates to CWE-789 (Memory Exhaustion), which describes a failure to limit resource consumption. When a user clicks an interactive message button, the client triggers an HTTP request to an integration endpoint specified by a potentially malicious server administrator or compromised integration. Without size limits, the server will attempt to load the entire response into memory, allowing an attacker controlling the integration endpoint to return multi-gigabyte payloads that exhaust heap memory and crash the service.
RemediationAI
Upgrade Mattermost to a patched version: 11.3.1 or later for the 11.3.x branch, 11.2.3 or later for 11.2.x, or 10.11.11 or later for 10.11.x (consult MMSA-2026-00571 for exact patched versions). If immediate patching is not feasible, implement the following interim controls: disable or restrict integration actions to trusted endpoints only via policy; enforce request/response timeouts and maximum payload sizes at the reverse proxy or load balancer (e.g., nginx with client_max_body_size and proxy_read_timeout directives); monitor memory consumption for unusual spikes coinciding with integration button clicks; and restrict access to message composition features to trusted users until patches are deployed. Test patches in a non-production environment before rolling out to avoid service disruption.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today