CVE-2026-2454: DoS in Calls plugin via malformed msgpack in websocket request.
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages to calls plugin. Mattermost Advisory ID: MMSA-2025-00537
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2454?
CVE-2026-2454 is classified as a high severity vulnerability due to the potential for denial of service (DoS) affecting the Mattermost server.
How do I fix CVE-2026-2454?
To resolve CVE-2026-2454, upgrade to Mattermost versions 11.3.1, 11.2.3, or 10.11.11 or later.
What systems are affected by CVE-2026-2454?
CVE-2026-2454 affects Mattermost versions 11.3.0 and earlier, 11.2.2 and earlier, and 10.11.10 and earlier.
What kind of attack does CVE-2026-2454 allow?
CVE-2026-2454 allows a malicious user to send malformed msgpack frames, leading to out-of-memory errors and server crashes.
Is CVE-2026-2454 exploitable remotely?
Yes, CVE-2026-2454 can be exploited remotely through websocket requests with corrupted msgpack frames.