VDB
CVE-2026-2454
CVE-2026-2454
PUBLISHED
CVSS 5.800000190734863 MEDIUM
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages to calls plugin. Mattermost Advisory ID: MMSA-2025-00537
EPSS 0.13% · 31.7th percentile
Risk Scores
CVSS 3.1
5.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
EPSS Score
0.13%
31.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 11.4.0, 11.2.0, 11.4.0 |
| mattermost | mattermost_server | 11.3.0, 11.2.0, 10.11.0 |
Timeline
- Mar 16, 2026 CVE Published
- Mar 17, 2026 EPSS Score
- Mar 17, 2026 CVE Updated
- Mar 18, 2026 EPSS Score
- Mar 19, 2026 EPSS Score
- Mar 20, 2026 EPSS Score
- Mar 21, 2026 EPSS Score
- Mar 22, 2026 EPSS Score
- Mar 22, 2026 Coalition ESS Score
- Mar 23, 2026 EPSS Score
- Mar 24, 2026 EPSS Score
- Mar 25, 2026 EPSS Score
References
- MMSA-2025-00537 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-2454 advisory