CVE-2026-25783: Denial of service via malformed User-Agent header in getBrowserVersion

Q: What is the severity of CVE-2026-25783?

CVE-2026-25783 is classified as a Denial of Service vulnerability affecting specific versions of Mattermost.

Q: How do I fix CVE-2026-25783?

To fix CVE-2026-25783, upgrade to Mattermost version 11.3.1 or later, 11.2.3 or later, or 10.11.11 or later.

Q: Which versions of Mattermost are affected by CVE-2026-25783?

Mattermost versions 11.3.0, 11.2.2, and 10.11.10 and earlier are affected by CVE-2026-25783.

Q: What causes the issue in CVE-2026-25783?

CVE-2026-25783 is caused by the failure to properly validate User-Agent header tokens in the affected Mattermost versions.

Q: Can untrusted users exploit CVE-2026-25783?

CVE-2026-25783 requires authentication, meaning only authenticated attackers can exploit this vulnerability.

Published Mar 16, 2026

Updated

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586

Affected Software

4 affected components

Mattermost Mattermost<=11.3.0, <=11.2.2, <=10.11.10

Mattermost Mattermost Server>=10.11.0<10.11.11

Mattermost Mattermost Server>=11.2.0<11.2.3

Mattermost Mattermost Server>=11.3.0<11.3.1

Remediation

Information

Update Mattermost to versions 11.4.0, 11.3.1, 11.2.3, 10.11.11 or higher.

Event History

Mar 16, 2026

CVE Published

via MITRE·12:04 PM

Data Sourced

via MITRE·12:04 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-25783?

CVE-2026-25783 is classified as a Denial of Service vulnerability affecting specific versions of Mattermost.

How do I fix CVE-2026-25783?