CVE-2026-21388
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Apr 09, 2026
Vendor
unknown
Description
Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the { {/lifecycle} } webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610