Denial of Service Vulnerability in Mattermost Product by Mattermost
CVE-2026-3114

6.5MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
26 March 2026

What is CVE-2026-3114?

Mattermost versions, including 11.4.x (up to 11.4.0), 11.3.x (up to 11.3.1), 11.2.x (up to 11.2.3), and 10.11.x (up to 10.11.11), exhibit a vulnerability in the file extraction process. This issue arises from the failure to properly validate decompressed archive entry sizes, which allows authenticated users with file upload privileges to exploit crafted ZIP files known as 'zip bombs'. By sending these specially designed archives, users can trigger a denial of service condition, exhausting server memory resources and impacting service availability. For more details, refer to the official Mattermost security advisory MMA-2026-00598.

Affected Version(s)

Mattermost 11.4.0

Mattermost 11.3.0 <= 11.3.1

Mattermost 11.2.0 <= 11.2.3

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

winfunc
.