CVE-2026-5740: Mattermost Server denial of service via msgpack WebSocket frames

CVE-2026-5740 · Severity: high · CVSS 7.5 · Published 2026-05-22

Mattermost, a popular collaboration and messaging platform, is vulnerable to a flaw that allows an attacker to crash the server. By sending a specially crafted message to the server's public communication channel, an unauthenticated user can force the system to shut down. This results in a total service outage, preventing all employees from communicating until the server is manually restarted.

Technologies: github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go), github.com/mattermost/mattermost/server/v8 (Go), Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-5740 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-5740 being exploited in the wild.
How severe is CVE-2026-5740?
High severity, with a CVSS score of 7.5, published 22 May 2026.
Which products and versions are affected?
github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.15+incompatible,introduced=11.4.0+incompatible,fixed=11.4.5+incompatible,introduced=11.5.0+incompatible,fixed=11.5.4+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=0,fixed=8.0.0-20260410202636-17939826efa2; and 1 more.
Is there a fix for CVE-2026-5740?
Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260410202636-17939826efa2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5740 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-5740?
Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later
    go get github.com/mattermost/mattermost-server@v11.6.1+incompatible
  • github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260410202636-17939826efa2 or later
    go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260410202636-17939826efa2

Technical details

A vulnerability exists in Mattermost Server's handling of WebSocket communications. The application fails to properly validate the size or structure of msgpack-encoded WebSocket frames before attempting to allocate memory for them (CWE-789). An unauthenticated remote attacker can exploit this by sending a crafted binary WebSocket message to the public WebSocket endpoint. This leads to excessive memory allocation, causing the server process to crash and resulting in a denial-of-service (DoS) condition. The issue is resolved in versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, and 10.11.15.

Affected products

  • Mattermost Mattermost Server 11.6.0, 11.5.0 to 11.5.3, 11.4.0 to 11.4.4, 10.11.0 to 10.11.14

Identifiers

  • CVE-2026-5740
  • GHSA-w9m8-p4cc-4qj9
  • GO-2026-5838

Timeline

  • 2026-05-22: advisory: Mattermost published advisory MMSA-2026-00647
  • 2026-05-22: disclosed: CVE-2026-5740 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.