Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T11:17:04.140Z",
  "pubdate": "2026-09-14T11:17:04.140Z",
  "executiveSummary": "Mattermost is susceptible to a Denial-of-Service (DoS) vulnerability caused by improper validation of zlib-compressed Session Description Protocol (SDP) messages.\nThe vulnerability stems from the lack of size constraints on unpacked payloads, allowing an attacker to trigger excessive memory consumption during the decompression process.\nAffected products include Mattermost versions 11.9.0 and earlier (11.9.x), 11.8.4 and earlier (11.8.x), 11.7.7 and earlier (11.7.x), and 10.11.22 and earlier (10.11.x).\nThis flaw allows a remote, unauthenticated attacker to crash the server or induce significant resource exhaustion by submitting multiple maliciously crafted, highly compressed SDP messages.\nSuccessful exploitation results in service unavailability for legitimate users, posing a critical risk to operational continuity for environments relying on Mattermost for real-time communication.\nAdvisory ID: MMSA-2026-00643.",
  "technicalDetails": "The vulnerability exists within the Mattermost SDP processing pipeline where the server handles zlib-compressed SDP data. The core issue is an 'Improper Resource Limitation' during the decompression phase, as the application fails to enforce a maximum size limit on the output buffer when expanding compressed input streams.\nSDP, commonly used in VoIP and WebRTC signaling, is susceptible to zip-bomb-style attacks when compression ratios are high. In this scenario, an attacker can craft a relatively small, highly compressed payload that expands to an order of magnitude larger size upon decompression. Because the application logic does not validate the final size of the buffer before or during allocation, the system attempts to allocate large contiguous blocks of memory for every incoming message.\nThe attack flow begins when an attacker sends specifically crafted SDP messages to the vulnerable Mattermost endpoint. These messages are processed by the internal zlib decompression routine. When the routine executes, it attempts to inflate the payload in memory to its full uncompressed size. By sending a flood of these malicious messages concurrently, an attacker can trigger rapid heap growth, leading to memory exhaustion.\nIn resource-constrained environments, this triggers an Out-Of-Memory (OOM) condition, forcing the operating system to terminate the Mattermost process to preserve system stability, resulting in an immediate crash. Even if an OOM kill does not occur, the garbage collector or memory allocator contention resulting from the massive allocation attempts can induce severe latency, effectively stalling service processing for all connected clients.\nThe vulnerability is particularly potent because it requires no specific user privileges or prior authentication. The processing of these SDP messages occurs early in the request pipeline, before session verification, making it accessible to any actor capable of reaching the relevant network endpoint. The impact is significant, as the server must expend disproportionately higher CPU and memory resources to process the malicious request compared to the attacker's resource expenditure for the submission. The post-exploitation impact is limited to availability degradation; however, continuous exploitation allows for persistent service denial."
}