Executive brief
Mattermost Server fails to properly limit the size of decompressed SDP (Session Description Protocol) messages, allowing an attacker to send specially crafted compressed messages that expand to extremely large sizes when unpacked. This can consume excessive server resources, causing denial of service or server crashes that disrupt team communication and collaboration for all users on the affected instance.
Technical details
The vulnerability is a zip bomb / decompression bomb issue affecting SDP message handling in Mattermost Server. The affected versions fail to enforce size limits on zlib-decompressed SDP message payloads, allowing an attacker to send a small compressed payload that unpacks to a very large size, consuming memory and CPU resources. The attack vector is network-based and does not require authentication. An attacker can exploit this by sending many malicious SDP messages to trigger resource exhaustion, resulting in denial of service or server crash. Patches are available in Mattermost 11.9.1+, 11.8.5+, 11.7.8+, and 10.11.23+.
Affected products
- Mattermost Mattermost Server 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22
Timeline
- 2026-09-14: disclosed