CVE-2026-6340
Mattermost Server 10.11.0 – 10.11.14
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2026-6340 is a medium-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Mattermost Mattermost Server. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30744
Vulnerability Data
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file…
more
with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping to application/system exploitation for DoS via crafted archive upload causing memory exhaustion (CWE-789).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of archive structure and size values before processing to block the excessive folder declarations that trigger memory exhaustion.
Limits effects of the resulting denial-of-service by enforcing resource quotas or throttling on file-processing operations.
Enables monitoring of memory and CPU usage during archive handling to identify anomalous consumption from crafted 7zip uploads.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding flaws that trust unvalidated size values for allocations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect and block excessive allocation flaws before deployment.
Secure development lifecycle includes input validation and size checks that prevent unbounded allocations.
Application security requirements mandate bounds checking on size parameters to avoid excessive memory allocation.
Secure architecture principles require resource-limit enforcement that mitigates uncontrolled memory requests.
Secure coding standards directly prohibit allocating memory from untrusted size values without validation.
Capacity management monitors overall resource use but does not prevent individual allocation bugs.