EUVD-2026-12416
GHSA-2v3w-6g35-5f9v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586
AnalysisAI
Mattermost fails to properly validate User-Agent header tokens in versions 11.3.0 and earlier, 11.2.2 and earlier, and 10.11.10 and earlier, allowing authenticated attackers to trigger request panics through specially crafted User-Agent headers. This denial-of-service vulnerability affects availability but requires prior authentication and results in only low-severity impact. While the CVSS score of 4.3 reflects the low severity, the practical risk depends on whether the application is exposed to untrusted authenticated users and whether automatic exploitation tools are readily available.
Technical ContextAI
The vulnerability resides in Mattermost's HTTP request handling layer, specifically in the User-Agent header parsing and validation mechanism. Under CWE-1287 (Improper Validation of Specified Quantity in Input), the application fails to implement robust bounds checking or format validation on the User-Agent header token before processing it. This likely manifests as a null pointer dereference, buffer overflow, or uncaught exception when the crafted header is processed, causing the request handler to panic and crash. The affected technology is Mattermost's core server component (cpe:2.3:a:mattermost:mattermost_server) versions spanning 10.11.x through 11.3.x, which handle HTTP request parsing as part of the collaborative messaging platform's request processing pipeline.
RemediationAI
Upgrade Mattermost Server to version 11.3.1 or later for 11.3.x deployments, version 11.2.3 or later for 11.2.x deployments, and version 10.11.11 or later for 10.11.x deployments. Consult the official Mattermost advisory (MMSA-2026-00586) and security update page at https://mattermost.com/security-updates/ for patch availability and detailed instructions. As interim mitigations before patching is feasible, implement rate limiting on HTTP requests with malformed or oversized User-Agent headers at the reverse proxy layer, restrict Mattermost access to authenticated users from known IP ranges, and configure monitoring alerts to detect request panic events in application logs. Consider deploying a Web Application Firewall (WAF) to sanitize inbound User-Agent headers.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today