CVE-2026-3116
Request Size Validation Flaw in Mattermost Plugins Causes DoS
Publication date: 2026-03-26
Last updated on: 2026-03-26
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | plugins | to 11.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Mattermost Plugins versions up to 11.4, 11.0.4, 11.1.3, 11.3.2, and 10.11.11.0. The issue is that these versions fail to validate the size of incoming requests properly. Because of this, an authenticated attacker can exploit the webhook endpoint by sending oversized requests, which can disrupt the service.
How can this vulnerability impact me? :
The impact of this vulnerability is a potential service disruption. An authenticated attacker can cause denial of service by exploiting the webhook endpoint with oversized requests, leading to unavailability or degraded performance of the affected Mattermost Plugins.