CVE-2026-24661: DoS in Mattermost Plugins

This vulnerability allows an authenticated attacker to cause a denial-of-service condition within a Mattermost instance. By crafting and sending oversized JSON payloads to the {{/changes}} webhook endpoint, the attacker can exhaust server memory resources. This can lead to the Mattermost service becoming unresponsive, impacting legitimate users' ability to communicate and collaborate. The impact is primarily focused on service availability, though prolonged denial of service could potentially lead to data loss if critical operations are interrupted. The attack requires authentication, limiting the scope of potential attackers to those with existing access to the Mattermost system.

1. Reserved2026-02-11
2. Published2026-04-09
3. EPSS updated2026-04-16

The primary mitigation for CVE-2026-24661 is to upgrade Mattermost Plugins to version 2.3.2.0 or later, which includes the fix for this vulnerability. If immediate upgrading is not feasible, consider implementing temporary workarounds such as rate limiting the number of requests to the {{/changes}} webhook endpoint. Additionally, configure your Mattermost server to have sufficient memory resources to handle legitimate traffic spikes. Monitor server resource utilization (CPU, memory) for unusual patterns that might indicate an ongoing attack. After upgrading, confirm the fix by sending a large JSON payload to the {{/changes}} webhook endpoint and verifying that the server does not experience memory exhaustion or service disruption.