CVE-2026-5740

Published: May 22, 2026Modified: Jul 23, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647

Affected (4)

Products: Mattermost: Mattermost Server

Mattermost

1 product

Mattermost Server

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mattermost Mattermost Server	From 10.11.0 to 10.11.15
Mattermost Mattermost Server	From 11.4.0 to 11.4.5
Mattermost Mattermost Server	From 11.5.0 to 11.5.4
Mattermost Mattermost Server	From 11.6.0 to 11.6.1

Related CWEs

CWE-789

Memory Allocation with Excessive Size Value

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

References (1)

https://mattermost.com/security-updates

Source: responsibledisclosure@mattermost.com

Vendor Advisory

Timeline

No history available yet.