PT-2026-28425 · Mattermost · Mattermost Plugins

Thecybertantrik · CVE-2026-3116 · Published 2026-03-26 · Updated 2026-03-26

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost Plugins versions 10.11.11.0 through 11.4

Description The software does not properly check the size of incoming requests, potentially allowing an authenticated attacker to disrupt service through the webhook endpoint. The issue affects the processing of requests sent to the /webhooks API endpoint. The request size is not validated, which can lead to a denial-of-service condition.

Recommendations Update to a version of Mattermost Plugins greater than 11.4.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-3116

Affected Products

Mattermost Plugins

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3116.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3116 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3116 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2037245586311626909 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3116 · Note