Review reviewHigh

CVE-2026-5740

Mattermost Mattermost, mattermost server

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647

CVSS: 7.5
EPSS: -
CISA KEV: Not listed
Published: 2026.05.22

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: Mattermost Mattermost, mattermost server
Affected versions: >= 11.6.0 <= 11.6.0, >= 11.5.0 <= 11.5.3, >= 11.4.0 <= 11.4.4, >= 10.11.0 <= 10.11.14, >= 10.11.0 < 10.11.15, >= 11.4.0 < 11.4.5, >= 11.5.0 < 11.5.4, >= 11.6.0 < 11.6.1
Fixed versions: 10.11.15, 11.4.5, 11.5.4, 11.6.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Mattermost Mattermost, mattermost server and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-789