CVE-2026-24458CWE-770

DoS attack via login attempts with multi-megabyte passwords

High · published March 16, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advisory ID: MMSA-2026-00587

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00283 · 19.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-03-16T12:02Z
EPSS history
Timeline
  • 16 MAR 12:02Z
    DoS attack via login attempts with multi-megabyte passwords
    cvelistv5