What is the CVSS score of CVE-2026-6340?

CVE-2026-6340 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6340?

Yes, a patch is available for CVE-2026-6340. Update the affected software to the latest version immediately.

Mattermost CVE-2026-6340

Q: Which versions of Mattermost are affected by CVE-2026-6340?

Memory exhaustion denial of service in Mattermost Server versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3 allows authenticated attackers to crash the server by…. A patch is available.

EUVD-2026-30744 MEDIUM

Memory Allocation with Excessive Size Value (CWE-789)

2026-05-18 Mattermost

GHSA-cjm8-jxpw-g43m

Mattermost Denial Of Service

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 08:17 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573

AnalysisAI

Memory exhaustion denial of service in Mattermost Server versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3 allows authenticated attackers to crash the server by uploading maliciously crafted 7zip archives containing excessive folder declarations. The vulnerability stems from insufficient validation of 7zip archive structure before decompression, enabling resource exhaustion attacks with low attack complexity. EPSS data not available, not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.

Technical ContextAI

This vulnerability affects Mattermost's file upload handling mechanism, specifically the 7zip archive decompression functionality. CWE-789 (Memory Allocation with Excessive Size Value) indicates the server fails to validate or limit the number of folder entries declared in 7zip archive headers before allocating memory. 7zip format allows metadata structures where an attacker can declare thousands or millions of folders without corresponding file data, causing the decompression library to pre-allocate memory for all declared structures. Mattermost's file attachment feature, commonly used for sharing archives in team collaboration, processes uploaded 7zip files without bounds checking on archive metadata, making it vulnerable to zip bomb variants targeting folder structures rather than compression ratios.

RemediationAI

Upgrade to patched Mattermost versions released after 11.5.1, 10.11.13, and 11.4.3 as specified in vendor security advisory MMSA-2026-00573 at https://mattermost.com/security-updates (exact fixed versions not independently confirmed from provided data - consult vendor advisory for precise upgrade targets). As an interim mitigation, restrict file upload permissions to trusted users only through Mattermost system console settings (System Console > Environment > File Storage), though this significantly reduces collaboration functionality. Alternatively, implement file size limits for 7zip uploads via reverse proxy rules (e.g., nginx location blocks limiting .7z files to 10MB), though sophisticated attackers can craft small files with excessive metadata. Monitor server memory usage and configure resource limits (ulimit, cgroups) to prevent complete system exhaustion, but note this may cause legitimate service degradation. Network segmentation to isolate Mattermost servers can contain impact but does not prevent authenticated user exploitation.