Mattermost fails to limit the size of responses from integration action endpoints, as stated in the vendor description: "Mattermost fails to limit the size of responses from integration action endpoints", allowing an authenticated attacker who controls a malicious integration server to trigger unbounded memory allocation. When a user clicks an interactive message button, the server processes an arbitrarily large payload and exhausts its memory, resulting in a denial of service. This weakness is identified as CWE-789, Uncontrolled Resource Consumption (CVE description).

The affected product is Mattermost Server. Vulnerable releases are 11.3.x through 11.3.0, 11.2.x through 11.2.2, and 10.11.x through 10.11.10. The vendor recommends upgrading to fixed versions 11.4.0, 11.3.1, 11.2.3, or 10.11.11 or later (vendor solution).

The CVSS score of 5.3 indicates moderate severity (scores). The EPSS score is less than 1%, reflecting a low likelihood of exploitation (scores). This vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated Mattermost user with access to an integration endpoint; when triggered, the server may become unavailable until memory is reclaimed or the service is restarted. Overall risk is moderate, but the probability remains low due to prerequisites.