Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint

This vulnerability allows an authenticated attacker to cause a denial-of-service condition within a Mattermost instance. By crafting and sending oversized JSON payloads to the {{/changes}} webhook endpoint, the attacker can exhaust server memory resources. This can lead to the Mattermost service becoming unresponsive, impacting legitimate users' ability to communicate and collaborate. The impact is primarily focused on service availability, though prolonged denial of service could potentially lead to data loss if critical operations are interrupted. The attack requires authentication, limiting the scope of potential attackers to those with existing access to the Mattermost system.

Organizations utilizing Mattermost Plugins, particularly those with custom integrations or automation workflows that rely on the {{/changes}} webhook endpoint, are at risk. Environments with limited server resources or inadequate monitoring practices are especially vulnerable to the impact of a denial-of-service attack.

• linux / server: Monitor Mattermost server resource utilization (CPU, memory) using tools like top, htop, or vmstat. Look for sudden spikes in memory usage, particularly related to the Mattermost process. Use journalctl -u mattermost to check for error messages related to memory allocation failures.

journalctl -u mattermost -g 'memory allocation failure'

• generic web: Monitor Mattermost server access logs for unusually large POST requests to the {{/changes}} webhook endpoint. Use grep to search for requests exceeding a predefined size threshold.

grep 'POST /api/v4/hooks/{{/changes}}.*Content-Length: [1-9][0-9]{6,}' /var/log/nginx/access.log

1. 2026-04-09Disclosure

   disclosure

1. Reservado2026-02-11
2. Publicada2026-04-09
3. EPSS atualizado2026-04-16

The primary mitigation for CVE-2026-24661 is to upgrade Mattermost Plugins to version 2.3.2.0 or later, which includes the fix for this vulnerability. If immediate upgrading is not feasible, consider implementing temporary workarounds such as rate limiting the number of requests to the {{/changes}} webhook endpoint. Additionally, configure your Mattermost server to have sufficient memory resources to handle legitimate traffic spikes. Monitor server resource utilization (CPU, memory) for unusual patterns that might indicate an ongoing attack. After upgrading, confirm the fix by sending a large JSON payload to the {{/changes}} webhook endpoint and verifying that the server does not experience memory exhaustion or service disruption.