CVE-2026-96260 in Mattermost
Summary
by MITRE • 09/23/2026
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.. Mattermost Advisory ID: MMSA-2026-00775
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Mattermost versions 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, and 11.10.x through 11.10.1 represents a critical failure in input validation mechanisms within the platform's plugin architecture. Specifically, the system fails to enforce a request body size limit during the Cross-Site Request Forgery (CSRF) validation process for requests directed at plugin endpoints. This architectural oversight allows an authenticated user to bypass standard resource consumption controls by submitting excessively large payloads. The core technical flaw lies in the sequence of operations where CSRF token verification occurs without prior or concurrent checks on the magnitude of the incoming data stream, creating a window for abuse that targets server-side resources rather than client-side logic.
From a technical perspective, this vulnerability is classified under CWE-400, which denotes Uncontrolled Resource Consumption. The absence of strict limits on request body size means that an attacker can craft HTTP POST requests with payloads significantly larger than the available heap memory or buffer capacity allocated for processing plugin interactions. When such large bodies are processed by the Mattermost server during CSRF validation, they consume substantial amounts of RAM and CPU cycles required to parse, validate, and potentially store the data temporarily before rejection. This behavior deviates from secure coding practices that mandate early termination of request processing when size constraints are exceeded, thereby preventing resource exhaustion attacks at the earliest possible stage in the HTTP lifecycle.
The operational impact of this vulnerability is a significant risk of Denial of Service (DoS) against Mattermost instances running affected versions. An authenticated attacker can exploit this flaw to exhaust server memory resources, leading to application crashes or severe performance degradation that affects all users connected to the instance. Since authentication is required, the attack surface is limited to malicious insiders or compromised accounts, but the severity remains high due to the potential for complete service unavailability. This aligns with MITRE ATT&CK technique T1498, Network Denial of Service, specifically sub-technique T1498.003 which involves flooding a target with requests that consume resources such as memory or CPU rather than bandwidth. The exploitation does not require privilege escalation beyond standard user rights but relies on the ability to send high-volume or large-payload HTTP traffic to plugin endpoints.
Mitigation strategies must prioritize immediate patching and configuration hardening. Organizations should upgrade Mattermost instances to versions 12.0.0 or later, where this issue has been resolved by implementing strict request body size limits prior to CSRF validation logic execution. In environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls (WAF) can be configured to drop HTTP requests with bodies exceeding a defined threshold before they reach the application server. Additionally, administrators should review plugin configurations and restrict access to sensitive endpoints if possible, ensuring that only trusted plugins are enabled and monitored for anomalous traffic patterns indicative of resource exhaustion attempts. Regular security audits focusing on input validation boundaries across all API surfaces are recommended to prevent similar oversights in future development cycles.