CVE-2026-4915

The record

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry.. Mattermost Advisory ID: MMSA-2026-00641

Affected packages

Related vulnerabilities

• CVE-2026-100352 kin-openapi is a Go project for handling OpenAPI files. CWE-754
• CVE-2026-98161 In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep… CWE-754
• CVE-2026-77411 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-754
• CVE-2026-87645 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed… CWE-754
• CVE-2026-87548 Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a… CWE-754
• CVE-2026-87532 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed… CWE-754
• CVE-2026-73314 XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST… CWE-754
• CVE-2026-85014 undici's experimental WebSocketStream client crashes the whole Node.js process when a… CWE-754