CVE-2026-21388: Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint

April 9, 2026 (updated April 29, 2026)

Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610.

References

github.com/advisories/GHSA-x274-8qfc-hrgf
github.com/mattermost/mattermost-plugin-msteams/commit/6fe4d295592ecc8767d67e69286cbeec01be3210
github.com/mattermost/mattermost-plugin-msteams/releases/tag/v2.3.2
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-21388

Code Behaviors & Features

Detect and mitigate CVE-2026-21388 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →