EUVD-2026-31425
GHSA-jmvr-r5hm-fxfr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable plugin endpoint needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is resource-exhaustion DoS only, so C:N/I:N/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints which allows an attacker to cause a denial of service via crafted oversized HTTP requests.. Mattermost Advisory ID: MMSA-2026-00646
AnalysisAI
Denial of service in Mattermost self-hosted server (versions 11.6.0, 11.5.x ≤11.5.3, 11.4.x ≤11.4.4, and 10.11.x ≤10.11.14) allows remote unauthenticated attackers to exhaust server resources by sending oversized HTTP requests to plugin endpoints, which fail to enforce request body size limits. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.04%, 11th percentile), but the flaw is remotely reachable without authentication and a vendor patch is available. Impact is limited to availability - no data disclosure or integrity loss.
Technical ContextAI
Mattermost is an open-source, self-hostable team collaboration and messaging platform whose functionality can be extended through server-side plugins that register their own HTTP endpoints. The root cause is CWE-400 (Uncontrolled Resource Consumption): the plugin HTTP request-handling path does not impose a maximum request body size, so the server will read and buffer arbitrarily large request bodies. Because the limit is missing at the plugin routing layer rather than in an individual plugin, any deployment that exposes plugin endpoints is affected, and an attacker can force excessive memory/CPU/bandwidth consumption. The affected CPE is cpe:2.3:a:mattermost:mattermost, i.e. the core Mattermost server application.
RemediationAI
Apply the vendor fix by upgrading to the patched release for your branch as directed in the Mattermost advisory (MMSA-2026-00646) at https://mattermost.com/security-updates; the specific fixed build should be taken from that advisory since the input confirms a patch is available but does not enumerate the exact fixed version numbers (upgrade past 11.6.0 / 11.5.3 / 11.4.4 / 10.11.14 to the corresponding patched point release). As a compensating control until patching, place the Mattermost server behind a reverse proxy (e.g. nginx) and enforce a request body size limit (such as client_max_body_size) on plugin/API paths, and rate-limit inbound requests - noting the trade-off that an overly small body limit can break legitimate large file uploads or plugin functionality, so size caps must accommodate expected attachment sizes. Restricting network exposure of the Mattermost server to trusted networks/VPN also reduces unauthenticated internet reachability. Additional references: https://vuldb.com/vuln/365184.
More in Mattermost
View allDenial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invit
Dex is a federated OpenID Connect provider written in Go. Rated critical severity (CVSS 9.6), this vulnerability is remo
Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers t
Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, wh
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker posse
Privilege escalation in Mattermost server (11.6.x, 11.5.x, and 10.11.x branches) allows a low-privileged user holding gr
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today