Mattermost EUVD-2026-109937

Requires an authenticated session on the Mattermost server (CVSS PR:L - any valid user account suffices, no admin needed) and the ability to open a WebSocket connection, which is standard client behavior. The attacker then sends a crafted binary WebSocket frame whose msgpack Bin32 header declares a byte-string payload length of up to 4,294,967,295 bytes; the vulnerable byte-string decode paths in the WebSocket msgpack decoder apply no allocation limit. No special non-default configuration is described in the evidence, and no user interaction (UI:N) by a victim is required. The primary limiting factor is the authentication requirement, so exposure scales with how trusted and how large the user base is; impact is confined to availability (service memory exhaustion), with no confidentiality or integrity effect. Affected branches: 11.10.x ≤ 11.10.1, 11.9.x ≤ 11.9.1, 11.8.x ≤ 11.8.5, 11.7.x ≤ 11.7.10.

This is a moderate-severity availability (denial-of-service) issue, not an information-disclosure flaw as one input tag suggests. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: a network-reachable, low-complexity attack that requires an authenticated session (PR:L) and yields availability impact only (C:N/I:N - no data exposure). The vuln.today decision label is 'this_month', indicating a prioritized-but-not-emergency remediation timeline rather than act_now/emergency. There is no CISA KEV listing and no EPSS score supplied, and no public exploit or PoC reference is present in the input, so there is no signal of active exploitation or available exploit code - consistent with a recently vendor-disclosed bug (reported by Mattermost, MMSA-2026-00768). The main driver of real risk is the trivially low bar once authenticated: any valid user can request an allocation of up to ~4 GB (4,294,967,295 bytes) per crafted frame, so the practical priority is higher for Mattermost instances with large, loosely-trusted, or self-service user populations than the 6.5 score alone implies. Note the input Tag 'Information Disclosure' conflicts with the CVSS confidentiality metric (C:N) and the CWE (CWE-789, memory allocation with excessive size value); the tag appears mislabeled and should be treated as a DoS/resource-exhaustion issue.

An authenticated Mattermost user (or a compromised low-privilege account) opens a WebSocket connection and sends a crafted binary msgpack frame declaring a Bin32 byte-string length of up to ~4 GB. Because the decoder applies no allocation limit to the byte-string decode path, the server attempts the full allocation, and repeated frames exhaust server memory and degrade or crash the service. No public exploit code is identified in the available data, but the attack is low-complexity for anyone able to authenticate.