What is the CVSS score of CVE-2026-5308?

CVE-2026-5308 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5308?

Yes, a patch is available for CVE-2026-5308. Update the affected software to the latest version immediately.

Mattermost CVE-2026-5308

Q: Which versions of Mattermost are affected by CVE-2026-5308?

Denial of service in Mattermost's plugin HTTP endpoint layer allows an authenticated high-privilege attacker to exhaust server resources by sending crafted oversized HTTP request bodies.. A patch is available.

EUVD-2026-31425 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-22 Mattermost

GHSA-jmvr-r5hm-fxfr

Denial Of Service Mattermost

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 11:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints which allows an attacker to cause a denial of service via crafted oversized HTTP requests.. Mattermost Advisory ID: MMSA-2026-00646

AnalysisAI

Denial of service in Mattermost's plugin HTTP endpoint layer allows an authenticated high-privilege attacker to exhaust server resources by sending crafted oversized HTTP request bodies. Affected across four concurrent release branches - 10.11.x through 11.6.x - with no published EPSS score and no confirmed active exploitation or public proof-of-concept at time of analysis. The CVSS score of 4.9 (Medium) accurately reflects the high-privilege prerequisite that meaningfully limits the realistic attacker population, though availability impact is rated High, meaning successful exploitation disrupts service availability entirely.

Technical ContextAI

Mattermost is a self-hosted team messaging and collaboration platform. Its plugin architecture exposes HTTP endpoints that third-party plugins can register and serve. CWE-400 (Uncontrolled Resource Consumption) is the root cause: the plugin HTTP handler layer does not impose an upper bound on incoming request body size. Without a body size limit, an HTTP server may buffer arbitrarily large payloads into memory or disk, causing resource exhaustion - memory pressure, thread starvation, or process crashes. This class of vulnerability is common in web frameworks that rely on application-layer developers to enforce limits rather than enforcing them in the middleware layer by default. The CPE string cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* covers all editions of the Mattermost server application. The EUVD entry EUVD-2026-31425 corroborates the affected version ranges reported by Mattermost.

RemediationAI

The primary remediation is to upgrade to a patched release per the Mattermost security advisory at https://mattermost.com/security-updates. Note that the advisory page lists fixed versions per branch, but no specific fixed version numbers were included in the available intelligence data - exact target upgrade versions must be confirmed directly from the vendor advisory before patching. As a compensating control where immediate patching is not feasible, administrators can restrict plugin installation and limit the set of active plugins that expose HTTP endpoints, reducing the available attack surface. Additionally, placing the Mattermost server behind a reverse proxy (e.g., nginx or HAProxy) configured with explicit client_max_body_size or equivalent request body size limits provides an independent enforcement layer that can block oversized requests before they reach the application. This proxy-level mitigation does not require downtime but introduces a dependency on proxy configuration correctness and does not address the underlying code deficiency.