CVE-2026-3114
Mattermost Server 10.11.0 – 10.11.12
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-3114 is a medium-severity Data Amplification (CWE-409) vulnerability in Mattermost Mattermost Server. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16242
Vulnerability Data
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate decompressed archive entry sizes during file extraction which allows authenticated users with file upload permissions to cause a denial of service via crafted…
more
zip archives containing highly compressed entries (zip bombs) that exhaust server memory.. Mattermost Advisory ID: MMSA-2026-00598
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Zip bomb upload enables application exploitation for endpoint DoS via memory exhaustion on archive processing.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of input data (decompressed archive sizes) before processing, blocking the zip-bomb extraction that exhausts memory.
Mandates protection against resource-exhaustion DoS attacks, covering the memory exhaustion caused by crafted compressed archives.
Enables monitoring and alerting on anomalous resource consumption or file-processing behavior indicative of zip-bomb uploads.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices include input-validation and resource-limit checks that prevent improper handling of compressed data.
Runtime monitoring of compute resources can detect exhaustion caused by decompression bombs.
Capacity planning and monitoring directly limits the availability impact of data-amplification attacks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can uncover decompression-bomb vulnerabilities before release.
Redundancy helps availability but does not address the root cause of the weakness.
Monitoring can detect anomalous resource usage but does not prevent the weakness.
Secure development lifecycle includes input validation and resource-limit checks that mitigate data-amplification attacks.
Application security requirements can mandate limits on decompression size and ratio.
Secure architecture principles encourage defensive design against resource-exhaustion threats.