CVE-2026-21388: DoS in Mattermost Plugins

This vulnerability allows an authenticated attacker to induce a denial-of-service condition within the Mattermost Plugins environment. By crafting and sending oversized JSON payloads to the {{/lifecycle}} webhook endpoint, the attacker can overwhelm the plugin's memory resources, causing it to become unresponsive or crash. This can disrupt critical plugin functionality and potentially impact the overall availability of the Mattermost instance. The impact is primarily limited to the plugin itself, but a prolonged DoS could indirectly affect other services relying on the plugin's functionality. Successful exploitation requires authentication, limiting the attack surface but still posing a risk in environments with compromised user accounts or weak authentication mechanisms.

1. Reserved2026-02-11
2. Published2026-04-09
3. EPSS updated2026-04-16

The primary mitigation for CVE-2026-21388 is to upgrade Mattermost Plugins to version 2.3.2.0 or later, which includes the fix for this vulnerability. If immediate upgrading is not feasible, consider implementing temporary workarounds to limit the size of incoming webhook payloads. This could involve configuring a reverse proxy or WAF to enforce maximum request body size limits. Additionally, review and restrict access to the {{/lifecycle}} webhook endpoint to only trusted sources. Monitor Mattermost plugin resource usage for signs of excessive memory consumption, which could indicate an ongoing attack. After upgrading, confirm the fix by sending a large JSON payload to the {{/lifecycle}} webhook endpoint and verifying that the plugin handles it gracefully without crashing or experiencing memory exhaustion.