Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610
References
| Link | Resource |
|---|---|
| https://mattermost.com/security-updates | Vendor Advisory |
Configurations
History
25 Apr 2026, 18:02
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mattermost mattermost Server
|
|
| CPE | cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* |
17 Apr 2026, 20:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://mattermost.com/security-updates - Vendor Advisory | |
| First Time |
Mattermost
Mattermost mattermost |
|
| CPE | cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* |
09 Apr 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-09 11:16
Updated : 2026-04-25 18:02
NVD link : CVE-2026-21388
Mitre link : CVE-2026-21388
CVE.ORG link : CVE-2026-21388
JSON object : View
Products Affected
mattermost
- mattermost_server
CWE
CWE-770
Allocation of Resources Without Limits or Throttling