CVE-2026-2454 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-2454 PUBLISHED CVSS 5.800000190734863 MEDIUM

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages to calls plugin. Mattermost Advisory ID: MMSA-2025-00537

EPSS 0.14% · 33.2th percentile

Risk Scores

CVSS v3.1

5.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

EPSS Score

0.14%

33.2th percentile

Affected Products

Vendor	Product	Versions
Mattermost	Mattermost	10.11.0, 11.3.0, 11.2.0
mattermost	mattermost_server	10.11.0, 11.3.0, 11.2.0

Timeline

Mar 16, 2026 CVE Published
Mar 17, 2026 EPSS Score
Mar 17, 2026 CVE Updated
Mar 18, 2026 EPSS Score
Mar 19, 2026 EPSS Score
Mar 20, 2026 EPSS Score
Mar 21, 2026 EPSS Score
Mar 22, 2026 EPSS Score
Mar 22, 2026 Coalition ESS Score
Mar 23, 2026 EPSS Score
Mar 24, 2026 EPSS Score
Mar 25, 2026 EPSS Score

References

MMSA-2025-00537 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-2454 advisory

Open in Interactive Console →