Description
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768
Published: 2026-10-26
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service via memory exhaustion
Action: Apply patch
AI Analysis

Impact

Mattermost allows an authenticated attacker to send a crafted msgpack binary WebSocket frame with a Bin32 payload length up to 4,294,967,295 bytes. The server fails to enforce allocation limits when decoding this payload, which can cause uncontrolled memory allocation and lead to denial‑of‑service. This weakness is identified as an unchecked resource allocation (CWE‑789).

Affected Systems

Mattermost Mattermost versions 11.9.0 through 11.9.1, 11.8.0 through 11.8.5, 11.7.0 through 11.7.10, and 11.10.0 through 11.10.1 are affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.5. It requires an authenticated remote user and exploits a flaw in the WebSocket msgpack decoder. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. An attacker who can log in to Mattermost can send the crafted frame to exhaust server memory, potentially causing the service to become unresponsive. The risk is moderate; remediation with a patch is recommended.

Generated by OpenCVE AI on October 26, 2026 at 16:46 UTC.

Remediation

Vendor Solution

Update Mattermost to versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or higher.

OpenCVE Recommended Actions

  • Upgrade Mattermost to at least version 11.11.0, 11.9.2, 11.8.6, 11.7.11, or 11.10.2 where the bug is fixed.
  • Configure a maximum WebSocket message size to limit resource consumption.
  • Monitor memory usage and application logs for abnormal spikes and set alerts to detect possible denial‑of‑service attempts.

Generated by OpenCVE AI on October 26, 2026 at 16:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://mattermost.com/security-updates cve-icon cve-icon
History

Mon, 26 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Mattermost
Mattermost mattermost
Vendors & Products Mattermost
Mattermost mattermost

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768
Title Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames
Weaknesses CWE-789
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Mattermost Mattermost
cve-icon MITRE

Status: PUBLISHED

Assigner: Mattermost

Published:

Updated: 2026-10-26T16:46:45.736Z

Reserved: 2026-09-18T18:40:09.913Z

Link: CVE-2026-93849

cve-icon Vulnrichment

Updated: 2026-10-26T16:40:48.739Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T15:16:46.367

Modified: 2026-10-26T17:17:31.240

Link: CVE-2026-93849

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T17:30:15Z

Weaknesses
  • CWE-789

    Memory Allocation with Excessive Size Value