CVE-2026-2454: Mattermost Server DOS Vulnerability

CVE-2026-2454 Overview

CVE-2026-2454 is a Denial of Service vulnerability affecting Mattermost Server that allows malicious users to crash the server by sending corrupted msgpack frames within websocket messages to the calls plugin. The vulnerability stems from improper handling of incorrectly reported array lengths, which can trigger out-of-memory (OOM) errors and cause a complete server crash.

Critical Impact

Remote attackers can exploit this vulnerability without authentication to cause server-wide denial of service, disrupting all Mattermost communications for the entire organization.

Affected Products

• Mattermost Server versions 11.3.x <= 11.3.0
• Mattermost Server versions 11.2.x <= 11.2.2
• Mattermost Server versions 10.11.x <= 10.11.10

Discovery Timeline

• March 16, 2026 - CVE-2026-2454 published to NVD
• March 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2454

Vulnerability Analysis

This vulnerability is classified under CWE-1287 (Improper Validation of Specified Type of Input). The core issue lies in how the Mattermost Server's calls plugin processes msgpack-encoded data received through websocket connections.

When the server receives a websocket message containing msgpack frames, it reads array length declarations to determine how much memory to allocate for parsing. An attacker can craft malicious msgpack frames that declare extremely large array lengths without providing the corresponding data. The server trusts these length declarations and attempts to allocate memory accordingly, leading to memory exhaustion.

The vulnerability is particularly severe because it can be exploited over the network without requiring any user interaction or authentication. The attack affects the changed scope, meaning a successful exploit impacts resources beyond the vulnerable component itself—specifically, the entire Mattermost server instance becomes unavailable.

Root Cause

The root cause is insufficient validation of array length values within msgpack frames before memory allocation occurs. The calls plugin does not verify that declared array lengths are reasonable or that sufficient data exists to populate the declared arrays. This allows attackers to specify arbitrarily large length values that trigger excessive memory allocation attempts.

Attack Vector

An attacker establishes a websocket connection to the Mattermost server and targets the calls plugin endpoint. By crafting specially malformed msgpack frames with exaggerated array length declarations, the attacker forces the server to allocate memory far beyond available resources. This triggers OOM conditions that crash the server process, denying service to all legitimate users.

The attack does not require authentication, operates over the network, and requires no user interaction—making it highly accessible to potential attackers. When successful, the server becomes completely unresponsive until manually restarted.

Detection Methods for CVE-2026-2454

Indicators of Compromise

• Unexpected Mattermost server crashes accompanied by out-of-memory error messages in logs
• Abnormal memory consumption spikes preceding server failures
• Unusual websocket connection patterns to the calls plugin endpoint
• Repeated server restarts within short time periods without clear cause

Detection Strategies

• Monitor system logs for OOM killer events targeting the Mattermost server process
• Implement websocket traffic analysis to detect malformed msgpack frames with suspicious array length declarations
• Configure memory usage alerting to trigger on abnormal consumption patterns
• Review calls plugin logs for parsing errors or exceptions related to msgpack deserialization

Monitoring Recommendations

• Establish baseline memory usage patterns for Mattermost server and alert on significant deviations
• Monitor websocket connection rates and durations to the calls plugin for anomalous behavior
• Implement rate limiting on websocket connections to reduce attack surface
• Enable verbose logging for the calls plugin to capture detailed parsing activity

How to Mitigate CVE-2026-2454

Immediate Actions Required

• Upgrade Mattermost Server to a patched version immediately (versions newer than 11.3.0, 11.2.2, or 10.11.10 for respective branches)
• Consider temporarily disabling the calls plugin if the feature is not critical to operations
• Implement network-level rate limiting on websocket connections as a defense-in-depth measure
• Ensure monitoring is in place to detect and alert on server crashes or memory exhaustion events

Patch Information

Mattermost has released security updates addressing this vulnerability. Organizations should upgrade to patched versions as documented in the Mattermost Security Updates advisory (MMSA-2025-00537). The fix implements proper validation of array length declarations within msgpack frames before memory allocation occurs.

Workarounds

• Disable the calls plugin entirely if voice/video calling functionality is not business-critical
• Implement Web Application Firewall (WAF) rules to inspect and filter malformed websocket traffic
• Deploy Mattermost behind a reverse proxy with connection rate limiting capabilities
• Configure system-level memory limits for the Mattermost process using cgroups or container resource constraints to prevent complete system impact

# Example: Disable calls plugin via mmctl
mmctl plugin disable com.mattermost.calls