← Database

CVE-2026-21388

LOW CVSS: 3.7 Published: 2026-04-09 Modified: 2026-06-17

Description

Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610

Affected Platforms

Mattermost Mattermost Server

Weakness Type

CWE-770

References