What is the CVSS score of CVE-2026-3116?

CVE-2026-3116 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-3116?

CVE-2026-3116 presents moderate security risk, a resource exhaustion vulnerability rated CVSS 4.9. Service availability could be impacted.

How to fix or mitigate CVE-2026-3116?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mattermost CVE-2026-3116

EUVD-2026-16246 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-03-26 Mattermost

Denial Of Service Mattermost

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16246

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:19 nvd

MEDIUM 4.9

DescriptionCVE.org

Mattermost Plugins versions <=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows an authenticated attacker to cause service disruption via the webhook endpoint. Mattermost Advisory ID: MMSA-2026-00589

AnalysisAI

Mattermost Plugins versions 11.4 and earlier fail to validate incoming request sizes on webhook endpoints, allowing authenticated attackers to trigger denial of service by sending oversized requests. The vulnerability affects multiple Mattermost release branches (10.x, 11.0.x, 11.1.x, 11.3.x) and has been assigned CVSS 4.9 (medium severity) with no public exploit identified at time of analysis. While exploitability requires high-privilege authentication and manual intervention, the lack of request size enforcement on webhooks represents a fundamental input validation gap that could disrupt service availability in production environments.

Technical ContextAI

The vulnerability stems from CWE-400 (Uncontrolled Resource Consumption), specifically the failure to implement request size limits on Mattermost webhook endpoints. Webhooks are HTTP-based integration points that accept incoming POST requests from external systems; without size validation, an authenticated attacker can exhaust server resources by sending exceptionally large payloads. This affects the Mattermost platform (CPE: cpe:2.3:a:mattermost:mattermost) across multiple plugin and core versions. The root cause is missing or inadequate input validation middleware that should reject requests exceeding a configured threshold before they are processed by application logic, allowing resource exhaustion attacks that degrade performance or cause service unavailability.

RemediationAI

Upgrade Mattermost to a patched version released after the MMSA-2026-00589 advisory (exact patch version not specified in available data; consult https://mattermost.com/security-updates for the latest release). Until patching is possible, implement network-level request size limits by deploying a reverse proxy (nginx, Apache, or cloud load balancer) configured to reject HTTP requests exceeding a reasonable size threshold (e.g., 10-50 MB depending on expected webhook payload sizes). Additionally, restrict webhook endpoint access to known, trusted IP ranges or require mutual TLS authentication for external webhook sources. Audit current webhook integrations to identify which systems have access and consider disabling unused webhooks temporarily.