What is the CVSS score of CVE-2026-24661?

CVE-2026-24661 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-24661?

Yes, a patch is available for CVE-2026-24661. Update the affected software to the latest version immediately.

Mattermost CVE-2026-24661

Q: Which versions of Mattermost are affected by CVE-2026-24661?

Mattermost Plugins versions 2.1.3.0 and earlier allow remote attackers without authentication to cause denial of service through memory exhaustion by sending oversized JSON payloads to the /changes…. A patch is available.

EUVD-2026-20882 LOW

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-09 Mattermost

GHSA-5rfv-h47g-xj42

Denial Of Service Mattermost

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 10:30 euvd

EUVD-2026-20882

Analysis Generated

Apr 09, 2026 - 10:30 vuln.today

CVE Published

Apr 09, 2026 - 10:12 nvd

LOW 3.7

DescriptionCVE.org

Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00611

AnalysisAI

Mattermost Plugins versions 2.1.3.0 and earlier allow remote attackers without authentication to cause denial of service through memory exhaustion by sending oversized JSON payloads to the /changes webhook endpoint. The vulnerability stems from a lack of request body size validation, enabling attackers to exhaust server memory and crash the service. CVSS is 3.7 (low severity) with low exploitability complexity, and no public exploit or active exploitation has been confirmed.

Technical ContextAI

The /changes webhook endpoint in Mattermost Plugins fails to implement request body size limits, a common defensive control for REST API endpoints. This directly relates to CWE-770 (Allocation of Resources Without Limits or Throttling), which describes the absence of safeguards against resource exhaustion attacks. The vulnerability affects the Mattermost application server plugin system (CPE: cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*), which processes webhook requests as part of integrations and event streaming. Without bounds checking on incoming JSON payloads, an attacker can progressively send larger requests until the application exhausts available heap memory, triggering out-of-memory errors and service unavailability. This is distinct from traditional denial-of-service attacks in that it targets a specific endpoint rather than consuming network bandwidth.

RemediationAI

Upgrade Mattermost Plugins to a version greater than 2.1.3.0; consult the Mattermost advisory at https://mattermost.com/security-updates/ for the specific patched version number. As an interim workaround pending patching, implement request body size limits at the reverse proxy or load balancer layer (e.g., nginx client_max_body_size, Apache LimitRequestBody) to restrict payloads sent to the /changes endpoint, and enable rate limiting on webhook endpoints to slow resource exhaustion attacks. Additionally, monitor server memory usage and configure alerting for unusual spikes in memory consumption on the Mattermost process.