CVE-2026-5132

Summary

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost11.9.0 <= 11.9.0affected
MattermostMattermost11.8.0 <= 11.8.4affected
MattermostMattermost11.7.0 <= 11.7.7affected
MattermostMattermost10.11.0 <= 10.11.22affected
MattermostMattermost11.10.0unaffected
MattermostMattermost11.9.1unaffected
MattermostMattermost11.8.5unaffected
MattermostMattermost11.7.8unaffected
MattermostMattermost10.11.23unaffected

Weaknesses

  • CWE-409: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References