Unbegrenzte Anfragekörper-Leseoperation im MS Teams Plugin {{/changes}} Webhook-Endpunkt

Exploitation of CVE-2026-24661 allows an authenticated attacker to cause a denial of service in Mattermost. By sending a large JSON payload to the {{/changes}} webhook endpoint, the server can be overwhelmed, leading to memory exhaustion and potentially crashing the service. This impacts the availability of Mattermost for legitimate users. The blast radius is limited to the affected Mattermost instance and its users. While the CVSS score is low, the impact of a DoS can still be significant, especially in critical environments.

Organizations utilizing Mattermost Plugins, particularly those with custom integrations or automation workflows that rely on the {{/changes}} webhook endpoint, are at risk. Environments with limited server resources or inadequate monitoring practices are especially vulnerable to the impact of a denial-of-service attack.

• linux / server: Monitor Mattermost server resource utilization (CPU, memory) using tools like top, htop, or vmstat. Look for sudden spikes in memory usage, particularly related to the Mattermost process. Use journalctl -u mattermost to check for error messages related to memory allocation failures.

journalctl -u mattermost -g 'memory allocation failure'

• generic web: Monitor Mattermost server access logs for unusually large POST requests to the {{/changes}} webhook endpoint. Use grep to search for requests exceeding a predefined size threshold.

grep 'POST /api/v4/hooks/{{/changes}}.*Content-Length: [1-9][0-9]{6,}' /var/log/nginx/access.log

1. 2026-04-09Disclosure

   disclosure

1. Reserviert2026-02-11
2. Veröffentlicht2026-04-09
3. EPSS aktualisiert2026-04-16

The primary mitigation is to upgrade Mattermost Plugins to version 2.3.2.0 or later. As a temporary workaround, consider implementing rate limiting on the {{/changes}} webhook endpoint to restrict the number of requests from a single source. Web application firewalls (WAFs) can also be configured to block excessively large requests. Monitor Mattermost server resource utilization (CPU, memory) for signs of unusual activity. After upgrading, confirm the fix by attempting to send a large JSON payload to the webhook endpoint and verifying that the server handles it gracefully without crashing.