Description
Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610
Published: 2026-04-09
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Update Mattermost Plugins to versions 2.3.2.0 or higher.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://mattermost.com/security-updates cve-icon cve-icon
History

Thu, 09 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Apr 2026 10:30:00 +0000

Type Values Removed Values Added
Description Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610
Title Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Mattermost

Published:

Updated: 2026-04-09T11:44:54.614Z

Reserved: 2026-02-11T20:56:06.579Z

Link: CVE-2026-21388

cve-icon Vulnrichment

Updated: 2026-04-09T11:44:50.805Z

cve-icon NVD

Status : Received

Published: 2026-04-09T11:16:20.897

Modified: 2026-04-09T11:16:20.897

Link: CVE-2026-21388

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses