Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Update Mattermost Plugins to versions 2.3.2.0 or higher.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://mattermost.com/security-updates |
|
History
Thu, 09 Apr 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610 | |
| Title | Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint | |
| Weaknesses | CWE-770 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Mattermost
Published:
Updated: 2026-04-09T11:44:54.614Z
Reserved: 2026-02-11T20:56:06.579Z
Link: CVE-2026-21388
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-09T11:16:20.897
Modified: 2026-04-09T11:16:20.897
Link: CVE-2026-21388
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses