Executive brief
Mattermost, a team communication platform, fails to enforce request body size limits when validating plugin requests, allowing an authenticated user to send extremely large requests that exhaust server memory. An attacker with valid credentials can trigger a denial of service, making the communication platform unavailable to legitimate users.
Technical details
The vulnerability exists in CSRF validation logic for plugin endpoints across affected versions, which does not enforce request body size limits before processing. An authenticated attacker can send a large request body to a plugin endpoint to exhaust server memory and cause denial of service. Patches are available in fixed versions for each affected release branch.
Affected products
- Mattermost Mattermost Server 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1
Timeline
- 2026-09-22: disclosed