CVE-2026-6340

The record

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573

Affected packages

Related vulnerabilities

• CVE-2026-112399 Pillow is a Python imaging library. CWE-789
• CVE-2026-112283 VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability… CWE-789
• CVE-2026-106569 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-789
• CVE-2026-106453 yawkat LZ4 Java provides LZ4 compression for Java. CWE-789
• CVE-2026-106452 yawkat LZ4 Java provides LZ4 compression for Java. CWE-789
• CVE-2026-77301 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. CWE-789
• CVE-2026-77410 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-789
• CVE-2026-53716 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-789