Executive brief
Mattermost, a collaboration and messaging platform, is vulnerable to a denial-of-service attack. An attacker can send specially crafted, oversized web requests to certain plugin components, which can overwhelm the server's resources. This could lead to the platform becoming unresponsive or crashing, disrupting communication and operations for all users.
Technical details
A resource consumption vulnerability (CWE-400) exists in Mattermost Server where plugin HTTP endpoints fail to enforce maximum request body size limits. An attacker with network access can exploit this by sending crafted, oversized HTTP requests to these endpoints. This lack of validation can lead to uncontrolled resource consumption, resulting in a denial-of-service (DoS) condition. While the vendor-provided CVSS score suggests high privileges (PR:H) may be required, the vulnerability effectively allows an authorized user to crash the service. Patches are available in versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, and 10.11.15.
Affected products
- Mattermost Mattermost Server 11.6.0, 11.5.0 - 11.5.3, 11.4.0 - 11.4.4, 10.11.0 - 10.11.14
Timeline
- 2026-05-22: advisory: Initial advisory published by Mattermost
- 2026-05-22: disclosed: CVE-2026-5308 published to NVD