CVE-2026-21388CWE-770

Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint

Low · published April 9, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
22.7
In the wild
Unconfirmed
What it is

Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.7th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-04-09T10:09Z
EPSS history
Timeline
  • 09 APR 10:09Z
    Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint
    cvelistv5