CVE-2026-96260

Received Received - Intake

Memory Exhaustion via Large Request in Mattermost

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Mattermost, Inc.

Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.. Mattermost Advisory ID: MMSA-2026-00775

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-96260

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost	to 11.9.1 (inc)
mattermost	mattermost	to 11.8.5 (inc)
mattermost	mattermost	to 11.7.10 (inc)
mattermost	mattermost	to 11.10.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

Mattermost versions between 11.7.x and 11.10.x fail to enforce a request body size limit during CSRF validation for plugin requests. This allows authenticated users to send large request bodies to plugin endpoints, consuming server memory and causing a denial of service.

Detection Guidance

This vulnerability involves a lack of request body size limits during CSRF validation in Mattermost plugin endpoints. To detect it, monitor for unusually large HTTP request bodies sent to plugin endpoints, especially POST requests. Check server logs for requests exceeding normal sizes or causing memory exhaustion. Inspect network traffic for abnormal payloads targeting plugin routes.

Impact Analysis

An authenticated user could exploit this to exhaust server resources, leading to service disruption or crashes. This affects availability but does not directly expose data or allow unauthorized access.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. GDPR requires maintaining service availability, while HIPAA mandates safeguards against disruptions that could compromise protected health information. The DoS risk here may violate these requirements.

Mitigation Strategies

Update Mattermost to a version that fixes this issue. Specifically, upgrade to versions beyond 11.9.1, 11.8.5, 11.7.10, or 11.10.1 depending on your current installation.

Hi! I’m here to help you understand CVE-2026-96260. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70