CVE-2026-21388
Received
Received - Intake
Denial of Service via Memory Exhaustion in Mattermost Plugins
Publication date: 2026-04-09
Last updated on: 2026-04-25
Assigner: Mattermost, Inc.
Description
Description
Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | to 2.3.1 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Mattermost Plugins versions up to 2.3.1 have a vulnerability where the request body size is not limited on the {{/lifecycle}} webhook endpoint.
This allows an authenticated attacker to send an oversized JSON payload which can cause memory exhaustion and lead to a denial of service.
How can this vulnerability impact me? :
The vulnerability can be exploited by an authenticated attacker to cause memory exhaustion on the affected system.
This results in a denial of service condition, potentially making the Mattermost Plugins unavailable or unstable.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70