CVE-2026-25783: Mattermost fails to properly validate User-Agent header tokens

March 16, 2026 (updated March 17, 2026)

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586

References

github.com/advisories/GHSA-2v3w-6g35-5f9v
github.com/mattermost/mattermost
github.com/mattermost/mattermost/commit/1346cf529aef0672c39a56ec10d1b8a9c8fb387d
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-25783

Code Behaviors & Features

Detect and mitigate CVE-2026-25783 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →