CVE-2026-6340: Mattermost doesn't validate 7zip archive structure before processing

May 18, 2026 (updated June 1, 2026)

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573

References

github.com/advisories/GHSA-cjm8-jxpw-g43m
github.com/mattermost/mattermost/commit/fb11968f8798925c7b75711025bc5f991124ba26
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-6340

Code Behaviors & Features

Detect and mitigate CVE-2026-6340 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →