{"id":"EUVD-2026-30744","enisaUuid":"d589dc2f-a351-3b79-9e57-bf9c7810cdff","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13, 11.4.x \u003c\u003d 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573","datePublished":"May 18, 2026, 7:08:56 AM","dateUpdated":"May 18, 2026, 12:43:56 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-6340\nGHSA-cjm8-jxpw-g43m\n","assigner":"Mattermost","epss":0.24,"enisaIdProduct":[{"id":"6674f558-4fff-34c2-a374-d34c55c71ec7","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.4.0 ≤11.4.3"},{"id":"930b121f-e46e-3955-b5b1-52187d6e13b5","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"},{"id":"cede9899-3507-3c60-a247-573e9e648e23","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"}],"enisaIdVendor":[{"id":"a88a974b-01cd-3b07-ab87-67b8fe54bf91","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"771c8a0e-c80a-3005-822f-821781997d6d","vulnerability":{"id":"GHSA-cjm8-jxpw-g43m","description":"Mattermost doesn\u0027t validate 7zip archive structure before processing","datePublished":"May 18, 2026, 9:31:47 AM","dateUpdated":"Jun 1, 2026, 3:09:30 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-6340\nhttps://github.com/mattermost/mattermost/commit/fb11968f8798925c7b75711025bc5f991124ba26\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30744\n","aliases":"CVE-2026-6340\nGHSA-cjm8-jxpw-g43m\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ffda98b1-6469-37bb-9ecd-52087e0863f0","vulnerability":{"id":"CVE-2026-6340","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13, 11.4.x \u003c\u003d 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573","datePublished":"May 18, 2026, 7:08:56 AM","dateUpdated":"May 18, 2026, 12:43:56 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30744\n","assigner":"Mattermost","epss":0.24,"dataProcessed":"Nov 5, 2026, 7:17:53 AM","vulnerabilityProduct":[{"id":"c1e36a66-e752-38cf-b076-9e6d3f936629","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.4.0 ≤11.4.3"},{"id":"e8e0385e-63bd-3c84-a1e9-62e3f7f6931e","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"},{"id":"ffdc432f-6778-3013-a98d-379991201574","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"}],"vulnerabilityVendor":[{"id":"92398cc1-b57c-32a5-ad7c-0a34121bd4db","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[]}