Memory Allocation Vulnerability in Mattermost WebSocket Message Pack Decoder

CVE-2026-93849

What is CVE-2026-93849?

A vulnerability exists in Mattermost's WebSocket msgpack decoder, affecting various versions. The lack of allocation limits allows an authenticated remote attacker to exploit this weakness. By sending a specially crafted binary WebSocket frame with an exceedingly large Bin32 payload length, reaching up to 4,294,967,295 bytes, an attacker can trigger excessive memory allocation, potentially leading to performance degradation or denial of service. This issue requires immediate attention to mitigate risks associated with unauthorized memory use.

References