CVE-2026-5740

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647

Scoring

Severity

HIGH

CVSS base score

7.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS probability

0.34%

CWE

CWE-789

Published

2026-05-22

Last modified

2026-05-22

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-789

Related vulnerabilities

• CVE-2026-83530 — Uncontrolled Memory Allocation in cel-go
• CVE-2026-86776 — KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size
• CVE-2026-19204 — A client may send a WebSocket frame with an unknown opcode and a very large declared payload...
• CVE-2026-85201 — In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a...
• CVE-2026-85445 — MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Count
• CVE-2026-85442 — MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation
• CVE-2026-84888 — RightNow-AI OpenFang tool_runner.rs shell_exec memory allocation
• CVE-2026-84857 — sigoden aichat API Endpoint serve.rs memory allocation

Markdown version · Browse all CVEs