PT-2026-25678 · Mattermost · Mattermost

CVE-2026-2456 · Published 2026-02-13 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.10 Mattermost versions 11.2.0 through 11.2.2 Mattermost versions 11.3.0 through 11.3.0

Description Mattermost does not limit the size of responses from integration action endpoints. This allows an authenticated attacker to cause server memory exhaustion and a denial of service. The attack involves a malicious integration server returning an arbitrarily large response when a user clicks an interactive message button. The affected API endpoint is the integration action endpoint. The response parameter from the integration server is the vulnerable component.

Recommendations Mattermost versions 10.11.0 through 10.11.10 should be updated. Mattermost versions 11.2.0 through 11.2.2 should be updated. Mattermost version 11.3.0 should be updated.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-789

CWE-400

Related Identifiers

BDU:2026-06565

CVE-2026-2456

GHSA-34G8-9FPP-46CH

GO-2026-4726

OPENSUSE-SU-2026:21483-1

SUSE-SU-2026:1135-1

Affected Products

Mattermost

References · 1749

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2456.json · Exploit
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2456 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2456 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4726 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-34g8-9fpp-46ch · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06565 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/fe3052073dc67e3c920baf9fe7efd44ac1d8124c · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note