CVE-2026-2458 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-2458 PUBLISHED CVSS 5.300000190734863 MEDIUM

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button.. Mattermost Advisory ID: MMSA-2026-00571

EPSS 0.03% · 8.4th percentile

Risk Scores

CVSS v3.1

5.300000190734863

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Score

0.03%

8.4th percentile

Affected Products

Vendor	Product	Versions
Mattermost	Mattermost	11.3.0, 11.2.0, 10.11.0

Timeline

Feb 16, 2026 CVE Published
Feb 16, 2026 PoC Published
Mar 16, 2026 EPSS Score
Mar 17, 2026 CVE Updated
Mar 17, 2026 EPSS Score
Mar 18, 2026 EPSS Score
Mar 18, 2026 Security Advisory
Mar 19, 2026 EPSS Score
Mar 20, 2026 EPSS Score
Mar 21, 2026 EPSS Score
Mar 22, 2026 EPSS Score
Mar 22, 2026 Coalition ESS Score

References

https://mattermost.com/security-updates/ advisory
MMSA-2026-00571 vendor-advisory

Open in Interactive Console →