CVE-2026-5740: Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

May 26, 2026 (updated June 29, 2026)

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647

References

github.com/advisories/GHSA-w9m8-p4cc-4qj9
github.com/mattermost/mattermost/commit/17939826efa20a97f087b3d390ec5136df350bae
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-5740

Code Behaviors & Features

Detect and mitigate CVE-2026-5740 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →