HIGHCVE-2026-24458Published Modified CNA Mattermost
CVE-2026-24458: DoS attack via login attempts with multi-megabyte passwords
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advisory ID: MMSA-2026-00587
Metrics
- CVSS v3.1
- 7.5
- Severity
- HIGH
- Fixed in
- 10.11.11
- Affected Products
- 1
Fix available
10.11.1111.2.311.3.111.4.0
Affected packages
- Mattermost / Mattermost≤ 11.3.0 · ≤ 11.2.2 · ≤ 10.11.10Fixed in 11.4.0, 11.3.1, 11.2.3, 10.11.11
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences