EUVD-2026-30744
GHSA-cjm8-jxpw-g43m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573
AnalysisAI
Memory exhaustion denial of service in Mattermost Server versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3 allows authenticated attackers to crash the server by uploading maliciously crafted 7zip archives containing excessive folder declarations. The vulnerability stems from insufficient validation of 7zip archive structure before decompression, enabling resource exhaustion attacks with low attack complexity. EPSS data not available, not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.
Technical ContextAI
This vulnerability affects Mattermost's file upload handling mechanism, specifically the 7zip archive decompression functionality. CWE-789 (Memory Allocation with Excessive Size Value) indicates the server fails to validate or limit the number of folder entries declared in 7zip archive headers before allocating memory. 7zip format allows metadata structures where an attacker can declare thousands or millions of folders without corresponding file data, causing the decompression library to pre-allocate memory for all declared structures. Mattermost's file attachment feature, commonly used for sharing archives in team collaboration, processes uploaded 7zip files without bounds checking on archive metadata, making it vulnerable to zip bomb variants targeting folder structures rather than compression ratios.
RemediationAI
Upgrade to patched Mattermost versions released after 11.5.1, 10.11.13, and 11.4.3 as specified in vendor security advisory MMSA-2026-00573 at https://mattermost.com/security-updates (exact fixed versions not independently confirmed from provided data - consult vendor advisory for precise upgrade targets). As an interim mitigation, restrict file upload permissions to trusted users only through Mattermost system console settings (System Console > Environment > File Storage), though this significantly reduces collaboration functionality. Alternatively, implement file size limits for 7zip uploads via reverse proxy rules (e.g., nginx location blocks limiting .7z files to 10MB), though sophisticated attackers can craft small files with excessive metadata. Monitor server memory usage and configure resource limits (ulimit, cgroups) to prevent complete system exhaustion, but note this may cause legitimate service degradation. Network segmentation to isolate Mattermost servers can contain impact but does not prevent authenticated user exploitation.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today