CVE-2026-5132
Last modified
CVE-2026-5132 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | >= 11.9.0, <= 11.9.0; >= 11.8.0, <= 11.8.4; >= 11.7.0, <= 11.7.7; >= 10.11.0, <= 10.11.22 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-5132?
How severe is CVE-2026-5132?
How do I fix CVE-2026-5132?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-51300Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-51301Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-51302Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-51303Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-51304Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-5131GREENmod uses named pipes for communication between plugins,…6.9
- CVE-2026-5134Improper neutralization of special elements used in an SQL c…9.8
- CVE-2026-51346SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and…9.1
- CVE-2026-5135A flaw was found in Foreman. This broken access control vuln…6.5
- CVE-2026-5136A flaw was found in Foreman. The Usergroup model in Foreman …8.8
- CVE-2026-51366SQL Injection vulnerability in Bottinelli Informatica Vedo S…9.9
- CVE-2026-51367An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows…7.5
Are you affected by CVE-2026-5132?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST