← Database

CVE-2026-24661

LOW CVSS: 3.7 Published: 2026-04-09 Modified: 2026-06-17

Description

Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00611

Affected Platforms

Mattermost Mattermost

Weakness Type

CWE-770

References