{"id":"CVE-2026-93849","kind":"vulnerability","aliases":["CVE-2026-93849"],"related":[],"title":"Mattermost: crafted WebSocket frame forces excessive server memory allocation","description":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768","summary":"Mattermost's WebSocket msgpack decoder does not limit byte-string allocations, so a crafted binary frame declaring a Bin32 length of up to 4,294,967,295 bytes makes the server allocate huge amounts of memory. An authenticated attacker can exhaust server memory and cause denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mattermost","package","self-hosted","websocket"],"not_affected_if":["patched-version"],"how_to_check":"- Run the Mattermost server version check (for example `mattermost version` or the System Console version page) and compare against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1\n- Confirm whether the instance is reachable by users who hold a login account","fix":"- Upgrade Mattermost to a release newer than the affected ranges: `11.7.11` or later on the 11.7 line, `11.8.6` or later on 11.8, `11.9.2` or later on 11.9, `11.10.2` or later on 11.10 (fixed versions inferred from the affected ranges; confirm against MMSA-2026-00768)","status":"open","published_at":"2026-10-26T15:16:46+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:03:51+00:00","updated_at":"2026-10-26T16:03:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T16:03:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mattermost to a release newer than the affected ranges: `11.7.11` or later on the 11.7 line, `11.8.6` or later on 11.8, `11.9.2` or later on 11.9, `11.10.2` or later on 11.10 (fixed versions inferred from the affected ranges; confirm against MMSA-2026-00768)","reach":"network","title":"Mattermost: crafted WebSocket frame forces excessive server memory allocation","impact":"medium","summary":"Mattermost's WebSocket msgpack decoder does not limit byte-string allocations, so a crafted binary frame declaring a Bin32 length of up to 4,294,967,295 bytes makes the server allocate huge amounts of memory. An authenticated attacker can exhaust server memory and cause denial of service.","category":"package","nicknames":[],"who_cares":["mattermost","self-hosted","websocket"],"confidence":0.7,"needs_auth":"yes","worst_case":"Server memory exhausted through crafted WebSocket frames, causing denial of service","analyst_note":"","how_to_check":"- Run the Mattermost server version check (for example `mattermost version` or the System Console version page) and compare against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1\n- Confirm whether the instance is reachable by users who hold a login account","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Self-hosted or managed Mattermost servers on the listed 11.7 through 11.10 versions are exposed, since any logged-in user can open a WebSocket connection and send frames. Instances on other major versions or already patched builds are not affected. unknown whether the sources name a specific deployment or configuration that changes exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000686,"input_tokens":3453,"output_tokens":682,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-00768':140C '-2026':11A,14A,139C '-93849':12A,15A '..':134C '11.10':82C '11.10.1':84C '11.7':79C '11.7.10':81C '11.8':76C '11.8.5':78C '11.9':73C '11.9.1':75C '294':47B,130C '295':49B,132C '4':46B,129C '967':48B,131C 'advisori':136C 'alloc':9A,33B,54B,89C,114C 'allow':104C 'amount':56B 'appli':88C 'attack':61B,108C 'authent':60B,106C 'bin32':41B,123C 'binari':37B,118C 'byte':31B,50B,94C,133C 'byte-str':30B,93C 'caus':67B,110C 'craft':2A,36B,117C 'cve':10A,13A 'declar':39B,121C 'decod':26B,96C,102C 'denial':68B 'excess':6A,111C 'exhaust':63B 'fail':86C 'forc':5A 'frame':4A,38B,120C 'host':20B 'huge':55B 'id':137C 'length':42B,125C 'limit':29B,90C 'make':51B 'mattermost':1A,16B,22B,71C,85C,135C 'memori':8A,58B,65B,113C 'mmsa':138C 'msgpack':25B,101C 'packag':17B 'path':97C 'payload':124C 'remot':107C 'self':19B 'self-host':18B 'server':7A,53B,64B,112C 'servic':70B 'string':32B,95C 'version':72C 'via':115C 'websocket':3A,21B,24B,100C,119C 'x':74C,77C,80C,83C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Mattermost servers on the listed 11.7 through 11.10 versions are exposed, since any logged-in user can open a WebSocket connection and send frames. Instances on other major versions or already patched builds are not affected. unknown whether the sources name a specific deployment or configuration that changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93849","severity":null,"published_at":"2026-10-26T15:16:46+00:00","modified_at":"2026-10-26T15:16:46+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}