CVE-2026-2454
Published: 16 March 2026
Description
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages to calls…
more
plugin. Mattermost Advisory ID: MMSA-2025-00537
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of WebSocket msgpack frames to reject malformed array lengths that trigger OOM errors in the Mattermost calls plugin.
Provides denial-of-service protection against unauthenticated remote OOM-induced server crashes via corrupted WebSocket messages.
Ensures error handling for invalid msgpack inputs does not result in exploitable crashes or OOM conditions.
Security SummaryAI
CVE-2026-2454 is a vulnerability in Mattermost versions 11.3.x up to and including 11.3.0, 11.2.x up to 11.2.2, and 10.11.x up to 10.11.10, stemming from a failure to properly handle incorrectly reported array lengths in msgpack frames. This issue affects the calls plugin when processing WebSocket messages, allowing malformed inputs to trigger out-of-memory (OOM) errors and crash the server. The vulnerability is cataloged under CWE-1287 and carries a CVSS v3.1 base score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L).
An unauthenticated attacker (PR:N) with network access can exploit this by sending corrupted msgpack frames via WebSocket messages targeted at the calls plugin. The attack requires low complexity and no user interaction, enabling remote denial-of-service through OOM-induced server crashes, though it has no impact on confidentiality or integrity.
Mattermost Advisory MMSA-2025-00537 provides details on mitigation; security practitioners should consult https://mattermost.com/security-updates for patching instructions and remediation steps applicable to the affected versions.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote attackers to trigger out-of-memory errors and server crashes via malformed WebSocket messages to the calls plugin, directly enabling application exploitation for endpoint denial-of-service.