Mattermost plugin HTTP endpoints fail to enforce request body size limits, permitting attackers to send arbitrarily large payloads that exhaust server resources, resulting in service disruption. This weakness is classified as CWE-400, uncontrolled resource consumption. The impact is a denial of service that could affect any component that accepts requests to those endpoints, without providing any user authentication or input validation.

Mattermost instances running versions 11.6.x through 11.6.0, 11.5.x through 11.5.3, 11.4.x through 11.4.4, or 10.11.x through 10.11.14 are vulnerable; newer releases are not affected.

The CVSS score of 4.9 denotes a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, with an attacker able to craft oversized HTTP requests over the network to the exposed plugin endpoints; no authentication is required. Although no publicly known exploits exist, the lack of a request size limit means that a malicious client can trigger a denial of service under any circumstances where a large payload is accepted.