{"id":"GHSA-cjm8-jxpw-g43m","revision":"1795bac36c1544b28525c36ca317c9f4","records":[{"revision":"1795bac36c1544b28525c36ca317c9f4","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-cjm8-jxpw-g43m","aliases":["CVE-2026-6340","GO-2026-5325"],"title":"Mattermost doesn't validate 7zip archive structure before processing","description":"Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573","state":0,"publishedAt":"2026-05-18T09:31:47+00:00","modifiedAt":"2026-06-25T19:56:01.4214628+00:00","affected":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"11.5.0"},{"kind":"fixed","version":"11.5.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.11.14"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"11.4.0"},{"kind":"fixed","version":"11.4.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"8.0.0-20260325191733-fb11968f8798"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.3.2-0.20260325191733-fb11968f8798"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-6340","https://github.com/mattermost/mattermost/commit/fb11968f8798925c7b75711025bc5f991124ba26","https://github.com/mattermost/mattermost","https://mattermost.com/security-updates"],"sourceUrl":"https://github.com/advisories/GHSA-cjm8-jxpw-g43m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-cjm8-jxpw-g43m","identifiers":["GHSA-cjm8-jxpw-g43m","CVE-2026-6340","GO-2026-5325"]},"retained":false,"historicalAffected":[]}],"coverage":[]}