CVE-2026-93849 in Mattermost
Summary
by MITRE • 10/26/2026
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Mattermost versions ranging from 11.7.x through 11.10.x represents a critical resource exhaustion flaw within the platform's WebSocket message handling subsystem. Specifically, this issue affects version ranges including 11.9.x up to and including 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.10, and 11.10.x up to 11.10.1. The core of the defect lies in the implementation of the msgpack decoder used for processing binary WebSocket frames. When a client sends a message declaring a Bin32 payload length, the server fails to enforce allocation limits on the byte-string decode paths. This oversight allows an authenticated remote attacker to trigger excessive memory consumption by submitting crafted binary WebSocket frames that specify a maximum possible payload size of 4,294,967,295 bytes, which corresponds to the upper limit of a signed 32-bit integer used for length declarations in this context.
From a technical perspective, the flaw is rooted in how the server allocates memory buffers prior to validating or processing the incoming data stream. In secure software design, parsers should implement strict limits on buffer sizes based on configuration parameters such as maximum message size settings defined by system administrators. However, in these affected Mattermost versions, the decoder proceeds to allocate a buffer corresponding to the declared length without sufficient checks against global memory constraints or configured thresholds. This behavior creates a direct path for resource exhaustion attacks where an attacker can consume significant portions of server RAM simply by opening authenticated WebSocket connections and sending large header declarations. The impact is particularly severe because it requires only authentication, which lowers the barrier for exploitation compared to unauthenticated remote code execution vulnerabilities, yet still poses a substantial risk to service availability.
The operational impact of this vulnerability centers on denial-of-service conditions affecting both individual user sessions and overall server stability. By repeatedly sending these oversized payload declarations, an attacker can cause the Mattermost application server to exhaust available memory resources. This leads to increased latency for legitimate users, potential crashes of worker processes, or complete unavailability of the chat platform if the operating system initiates out-of-memory killer procedures that terminate critical services. Such disruptions undermine the reliability and availability guarantees expected from enterprise communication platforms. Furthermore, because the attack requires authentication, it may be executed by compromised user accounts or insiders with malicious intent, making detection more challenging than attacks originating from external unauthenticated sources.
This vulnerability aligns closely with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-789, Memory Allocation with Excessive Size Value. In terms of the MITRE ATT&CK framework, this behavior is consistent with techniques related to resource exhaustion attacks that aim to degrade service availability rather than compromise confidentiality or integrity directly. The attack vector leverages authenticated access, placing it within the context of lateral movement or insider threat scenarios where an attacker seeks to disrupt operations after gaining initial foothold privileges.
To mitigate this risk, organizations running affected versions must upgrade immediately to patched releases outside the specified vulnerable ranges. Administrators should verify their current Mattermost version against the advisory MMSA-2026-00768 and apply updates provided by the vendor as soon as they become available in stable channels. In addition to patching, it is advisable to review WebSocket configuration settings to ensure that maximum message size limits are appropriately configured at both the application level and any reverse proxy or load balancer layer preceding the Mattermost instance. Implementing rate limiting on WebSocket connections can also help mitigate the impact of such attacks by restricting the frequency with which clients can send large payload declarations, thereby reducing the window for successful resource exhaustion attempts even if a vulnerability remains present in older deployments awaiting patch cycles.