What’s Vulnerable › Vulnerabilities

CVE-2026-93849: Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-26
• Weakness: CWE-789

Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768

Affected products

• Mattermost: from 11.9.0 through 11.9.1; from 11.8.0 through 11.8.5; from 11.7.0 through 11.7.10; from 11.10.0 through 11.10.1

References

• https://mattermost.com/security-updates

Get alerted when CVE-2026-93849 or the next vulnerability affects your stack