Live › vulnerability › CVE-2026-93849
Go to dashboardMattermost's WebSocket msgpack decoder does not limit byte-string allocations, so a crafted binary frame declaring a Bin32 length of up to 4,294,967,295 bytes makes the server allocate huge amounts of memory. An authenticated attacker can exhaust server memory and cause denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost servers on the listed 11.7 through 11.10 versions are exposed, since any logged-in user can open a WebSocket connection and send frames. Instances on other major versions or already patched builds are not affected. unknown whether the sources name a specific deployment or configuration that changes exposure.
No product ranges from the sources yet.
mattermost version or the System Console version page) and compare against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.111.7.11 or later on the 11.7 line, 11.8.6 or later on 11.8, 11.9.2 or later on 11.9, 11.10.2 or later on 11.10 (fixed versions inferred from the affected ranges; confirm against MMSA-2026-00768)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768
This page as .md · .json · in your agent: get_signal("CVE-2026-93849")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.