CVE-2026-2456 MEDIUM

CVE-2026-2456: Denial of Service via Unbounded Memory Allocation in Integration Actions

Vendor Mattermost
Product Mattermost
Weakness CWE-789
Published March 16, 2026
Last update March 16, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button.. Mattermost Advisory ID: MMSA-2026-00571

Key dates

02Disclosure timeline

March 16, 2026 CVE published
March 16, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2020-5303 Denial of service in Tendermint CVE-2026-41312 pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM CVE-2026-44375 Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException CVE-2025-61910 NASA ION-DTN BPv7 4.1.3s Uncontrolled Memory Allocation that leads to Denial-of-Service CVE-2026-22026 CryptoLib Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource Exhaustion