Mattermost plugin versions up to and including 2.3.1 permit an authenticated attacker to directly trigger a memory exhaustion condition by sending an oversized JSON payload to the {{/lifecycle}} webhook endpoint. This flaw leads to a denial of service, as the system allocates excessive memory and may become unresponsive or crash. The weakness is a classic unbounded request body read, corresponding to CWE‑770.

The issue affects the Mattermost plugin system. Any installation of Mattermost plugins at version 2.3.1 or older is vulnerable, regardless of the overall Mattermost server version. The vulnerability requires the attacker to be authenticated to the platform.

The CVSS score of 3.7 indicates moderate severity. No EPSS data and the vulnerability is not listed in CISA’s KEV catalog, suggesting no documented widespread exploitation. However, exploitation requires the attacker to possess valid credentials and to craft a large JSON payload to the webhook; once achieved, the attack is straightforward and results in service disruption.