{"id":"CVE-2026-93849","aliases":[],"title":"Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames","titleSource":"Mattermost","descriptionSource":"Mattermost","products":[{"vendor":"Mattermost","name":"Mattermost","platforms":[],"versions":[{"version":"11.9.0","status":"affected","lessThanOrEqual":"11.9.1","versionType":"semver"},{"version":"11.8.0","status":"affected","lessThanOrEqual":"11.8.5","versionType":"semver"},{"version":"11.7.0","status":"affected","lessThanOrEqual":"11.7.10","versionType":"semver"},{"version":"11.10.0","status":"affected","lessThanOrEqual":"11.10.1","versionType":"semver"},{"version":"11.11.0","status":"unaffected"},{"version":"11.9.2","status":"unaffected"},{"version":"11.8.6","status":"unaffected"},{"version":"11.7.11","status":"unaffected"},{"version":"11.10.2","status":"unaffected"}],"defaultStatus":"unaffected","source":"Mattermost","url":"https://www.cve.org/CVERecord?id=CVE-2026-93849"}],"remediation":[{"text":"Update Mattermost to versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or higher.","source":"Mattermost","url":"https://www.cve.org/CVERecord?id=CVE-2026-93849"}],"description":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768","severity":"medium","score":6.5,"published":"2026-10-26T14:25:26.554Z","modified":"2026-10-26T16:46:45.736Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://mattermost.com/security-updates"],"sources":[{"name":"CVE","id":"CVE-2026-93849","modified":"2026-10-26T16:46:45.736Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93849"}],"assessments":[{"source":"Mattermost","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T02:20:33.012Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}