CVE-2026-93849

The record

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768

Affected packages

Related vulnerabilities

• CVE-2026-63476 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-789
• CVE-2026-83594 Memory allocation with an excessive size value in Apache Wicket. CWE-789
• CVE-2026-62297 ag-psd is a JavaScript library for reading and writing Photoshop Document files. CWE-789
• CVE-2026-62254 LibreDWG is a free C library to read and write DWG files. CWE-789
• CVE-2026-61845 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-789
• CVE-2026-115865 Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to… CWE-789
• CVE-2026-119280 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-789
• CVE-2026-119278 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-789