sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Medium 6.5 Published Updated

An authenticated user can cause a denial of service by sending large request bodies to plugin endpoints due to missing size limits.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2026-96260?

CVE-2026-96260 is a medium-severity denial of service vulnerability in Mattermost Mattermost Server, published on 22 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.. Mattermost Advisory ID: MMSA-2026-00775

Weakness: CWE-789

Which versions are affected by CVE-2026-96260?

It affects 1 product.

Products include Mattermost Mattermost Server.

How do I fix CVE-2026-96260?

No fix has been published for CVE-2026-96260 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-96260 being exploited?

There is no known exploitation of CVE-2026-96260 in the wild and no public exploit code.

All Mattermost Mattermost Server vulnerabilities

Sources

Also known as GHSA-p28q-hqh3-qh95.

Is CVE-2026-96260 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free