CVE-2026-6340: Memory Exhaustion via Malicious 7zip File Upload
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.5.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.14 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.4.4 - Compensating control
Mitigate the issue by preventing authenticated attackers from uploading specially crafted 7zip files until Mattermost is upgraded per MMSA-2026-00573.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6340?
CVE-2026-6340 has been classified as a critical vulnerability due to its potential to cause denial of service by exhausting server memory.
How do I fix CVE-2026-6340?
To address CVE-2026-6340, upgrade Mattermost to version 11.5.2 or later, 10.11.14 or later, or 11.4.4 or later.
Who is affected by CVE-2026-6340?
CVE-2026-6340 affects Mattermost versions 11.5.x up to and including 11.5.1, 10.11.x up to and including 10.11.13, and 11.4.x up to and including 11.4.3.
What type of attack does CVE-2026-6340 enable?
CVE-2026-6340 enables an authenticated attacker to upload a malicious 7zip file, leading to server memory exhaustion.
Is there a workaround for CVE-2026-6340?
Currently, the recommended approach for CVE-2026-6340 is to apply the available updates rather than relying on workarounds.