Description
Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00611
Published: 2026-04-09
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Update Mattermost Plugins to versions 2.3.2.0 or higher.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://mattermost.com/security-updates cve-icon cve-icon
History

Thu, 09 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Apr 2026 10:30:00 +0000

Type Values Removed Values Added
Description Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00611
Title Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Mattermost

Published:

Updated: 2026-04-09T11:44:35.023Z

Reserved: 2026-02-11T20:56:06.566Z

Link: CVE-2026-24661

cve-icon Vulnrichment

Updated: 2026-04-09T11:44:30.263Z

cve-icon NVD

Status : Received

Published: 2026-04-09T11:16:21.047

Modified: 2026-04-09T11:16:21.047

Link: CVE-2026-24661

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses