What is the CVSS score of EUVD-2026-16242?

EUVD-2026-16242 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by EUVD-2026-16242?

CVE-2026-3114 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-16242?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mattermost EUVD-2026-16242

| CVE-2026-3114 MEDIUM

Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)

2026-03-26 Mattermost

GHSA-vhgh-g7x8-4rx8

Denial Of Service File Upload Mattermost

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16242

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:21 nvd

MEDIUM 6.5

DescriptionCVE.org

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate decompressed archive entry sizes during file extraction which allows authenticated users with file upload permissions to cause a denial of service via crafted zip archives containing highly compressed entries (zip bombs) that exhaust server memory.. Mattermost Advisory ID: MMSA-2026-00598

AnalysisAI

Mattermost server versions 10.11.x through 11.4.x fail to validate decompressed archive entry sizes during ZIP file extraction, allowing authenticated users with file upload permissions to trigger denial of service by uploading crafted zip bombs that exhaust server memory. The vulnerability affects Mattermost 10.11.0-10.11.11, 11.2.0-11.2.3, 11.3.0-11.3.1, and 11.4.0, with CVSS 6.5 (medium) reflecting the requirement for prior authentication and limited scope (availability impact only). No public exploit identified at time of analysis, though the attack vector is network-accessible and requires low complexity once an attacker has valid upload credentials.

Technical ContextAI

The vulnerability exists in Mattermost's file extraction logic, specifically in the handling of ZIP archive decompression (CWE-409: Improper Resource Validation). When processing file uploads, the application decompresses ZIP entries without validating the decompressed size against server memory constraints. An attacker can craft a ZIP archive where individual entries are highly compressed but expand to extremely large sizes in memory upon decompression-a classic zip bomb attack pattern. The affected product is identified via CPE (cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*), affecting the core Mattermost server application. The root cause is inadequate input validation on untrusted file uploads, allowing memory exhaustion as a vector for denial of service.

RemediationAI

Upgrade Mattermost to a patched version released after the affected ranges; consult https://mattermost.com/security-updates for the specific fixed version in each branch. Until patching is completed, implement compensating controls: restrict file upload permissions to trusted internal users only via Mattermost role-based access controls; monitor server memory usage and set memory limits at the container/OS level to prevent process crashes from memory exhaustion; implement rate limiting on file upload endpoints to slow potential attacks; consider disabling ZIP file uploads entirely if not essential to operations. Organizations should prioritize patching over workarounds given the straightforward nature of the fix.