Description
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry.. Mattermost Advisory ID: MMSA-2026-00641
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mattermost Mattermost
Default version status: unaffected
11.6.0 to ≤ 11.6.0affected11.5.0 to ≤ 11.5.3affected11.4.0 to ≤ 11.4.4affected10.11.0 to ≤ 10.11.14affected11.7.0unaffected11.6.1unaffected11.5.4unaffected11.4.5unaffected10.11.15unaffected