CVE-2026-93849

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a...

CVE-2026-93849 Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a...

CVE-2026-93849

The Mattermost messaging platform (versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x

EUVD-2026-109937

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a...

PT-2026-123372

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a...

Mattermost resource management error vulnerability

Versions 11.9.1 and earlier of Mattermost, as well as versions 11.8.5 and earlier, 11.7.10 and earlier, and 11.10.1 and earlier are affected by a resource management error vulnerability. This vulnerability arises because the WebSocket msgpack decoder fails to enforce allocation limits on byte...

jsoncons:fuzz_msgpack: Heap-buffer-overflow in jsoncons::heap::heap_string_factory<unsigned char, unsigned long, std::__1::allo

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=5217334684614656 Project: jsoncons Fuzzing Engine: honggfuzz Fuzz Target: fuzzmsgpack Job Type: honggfuzzasanjsoncons Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

SUSE CVE-2026-32284

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data format codes 0xd4-0xd8. This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack...

CVE-2026-32284

A flaw was found in the msgpack decoder. A remote attacker could send specially crafted, truncated fixext data to an application using the msgpack library. This improper input validation can lead to an out-of-bounds read and a runtime panic, resulting in a denial of service DoS attack against the...

EUVD-2026-16343

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data format codes 0xd4-0xd8. This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack...

CVE-2026-32284 Denial of service in github.com/shamaton/msgpack

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data format codes 0xd4-0xd8. This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack...

CVE-2026-32284

The msgpack decoder contains a vulnerability where it fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). An attacker could exploit this by sending specially crafted data to an application using the msgpack library, leading to an out-...

Denial of service in github.com/shamaton/msgpack

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data format codes 0xd4-0xd8. This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack...