cve.bz

CVE-2026-26233

6.5 mediumEPSS 0.3%

Medium (6.5) in mattermost mattermost server. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost-server 10.11.12, 10.11.12+incompatible, 11.2.4.

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows unauthenticated remote attackers to cause denial of service (server crash and restart) via HTTP/2 single packet attack with 100+ parallel login requests.. Mattermost Advisory ID: MMSA-2025-00566

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS
0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE
CWE-400
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-247x-7qw8-fp98Gogithub.com/mattermost/mattermost-server>=11.4.0-rc1 <11.4.111.4.1
GHSA-247x-7qw8-fp98Gogithub.com/mattermost/mattermost-server>=11.3.0-rc1 <11.3.211.3.2
GHSA-247x-7qw8-fp98Gogithub.com/mattermost/mattermost-server>=11.2.0-rc1 <11.2.411.2.4
GHSA-247x-7qw8-fp98Gogithub.com/mattermost/mattermost-server>=10.11.0-rc1 <10.11.1210.11.12
GO-2026-4916Gogithub.com/mattermost/mattermost-server>=10.11.0-rc1+incompatible <10.11.12+incompatible
>=11.2.0-rc1+incompatible <11.2.4+incompatible
>=11.3.0-rc1+incompatible <11.3.2+incompatible
>=11.4.0-rc1+incompatible <11.4.1+incompatible		10.11.12+incompatible, 11.2.4+incompatible, 11.3.2+incompatible, 11.4.1+incompatible

References

Check your stackJSON