CVE-2026-5132

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS probability

0.24%

CWE

CWE-409

Published

2026-09-14

Last modified

2026-09-14

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-409

Related vulnerabilities

• CVE-2025-66471 — urllib3 Streaming API improperly handles highly compressed data
• CVE-2026-22776 — cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb
• CVE-2026-15814 — Uploading a crafted image causes excessive memory allocation in the Mattermost Server
• CVE-2026-14298 — Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost
• CVE-2026-10819 — Mattermost Server Denial of Service via Animated GIF Emoji Upload
• CVE-2026-21441 — urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
• CVE-2024-7765 — Denial of Service in h2oai/h2o-3
• CVE-2024-3572 — XML External Entity (XXE) Vulnerability in scrapy/scrapy

Markdown version · Browse all CVEs