CVE-2026-5740: Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

May 26, 2026 (updated June 29, 2026)

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647

References

github.com/advisories/GHSA-w9m8-p4cc-4qj9
github.com/mattermost/mattermost/commit/17939826efa20a97f087b3d390ec5136df350bae
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-5740

Code Behaviors & Features

Detect and mitigate CVE-2026-5740 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →