# CVE-2026-5308: Mattermost denial of service in plugin HTTP endpoints

Source: https://junglewise.ai/threats/cve-2026-5308-mattermost-denial-of-service-in-plugin-http-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-5308 · Severity: high · CVSS 7.5 · Published 2026-05-22

Mattermost, a collaboration and messaging platform, is vulnerable to a denial-of-service attack. An attacker can send specially crafted, oversized web requests to certain plugin components, which can overwhelm the server's resources. This could lead to the platform becoming unresponsive or crashing, disrupting communication and operations for all users.

Technologies: [github.com/mattermost/mattermost-plugin-github (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-plugin-github), [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server), [Mattermost GitHub Plugin](https://junglewise.ai/threats/technologies/github-plugin), [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-5308 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5308 being exploited in the wild.

**How severe is CVE-2026-5308?** High severity, with a CVSS score of 7.5, published 22 May 2026.

**Which products and versions are affected?** github.com/mattermost/mattermost-plugin-github (Go) SEMVER:introduced=0,fixed=1.0.1-0.20260410143745-9b41b1fd43c4; github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.15+incompatible,introduced=11.4.0+incompatible,fixed=11.4.5+incompatible,introduced=11.5.0+incompatible,fixed=11.5.4+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; Mattermost GitHub Plugin < 1.0.1-0.20260410143745-9b41b1fd43c4; Mattermost Server 11.6.0, 11.5.0 - 11.5.3, 11.4.0 - 11.4.4, 10.11.0 - 10.11.14, 11.6.0, 11.5.0 to 11.5.3, 11.4.0 to 11.4.4, 10.11.0 to 10.11.14.

**Is there a fix for CVE-2026-5308?** Yes. github.com/mattermost/mattermost-plugin-github (Go): upgrade to 1.0.1-0.20260410143745-9b41b1fd43c4 or later; github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5308 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5308?** Check whether you run github.com/mattermost/mattermost-plugin-github (Go), github.com/mattermost/mattermost-server (Go), Mattermost GitHub Plugin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/mattermost/mattermost-plugin-github (Go): upgrade to 1.0.1-0.20260410143745-9b41b1fd43c4 or later

  ```sh
  go get github.com/mattermost/mattermost-plugin-github@v1.0.1-0.20260410143745-9b41b1fd43c4
  ```

- github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later

  ```sh
  go get github.com/mattermost/mattermost-server@v11.6.1+incompatible
  ```


## Technical details

A resource consumption vulnerability (CWE-400) exists in Mattermost Server where plugin HTTP endpoints fail to enforce maximum request body size limits. An attacker with network access can exploit this by sending crafted, oversized HTTP requests to these endpoints. This lack of validation can lead to uncontrolled resource consumption, resulting in a denial-of-service (DoS) condition. While the vendor-provided CVSS score suggests high privileges (PR:H) may be required, the vulnerability effectively allows an authorized user to crash the service. Patches are available in versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, and 10.11.15.

## Affected products

- Mattermost Mattermost Server 11.6.0, 11.5.0 - 11.5.3, 11.4.0 - 11.4.4, 10.11.0 - 10.11.14

## Identifiers

- CVE-2026-5308
- GHSA-jmvr-r5hm-fxfr
- GO-2026-5836

## Timeline

- 2026-05-22: advisory: Initial advisory published by Mattermost
- 2026-05-22: disclosed: CVE-2026-5308 published to NVD

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10)
- [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1)
- [Mattermost authentication token leak in server logs](https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)