Skip to content

Commit ff3233d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-37j2-3vv8-cf24 GHSA-jmvr-r5hm-fxfr GHSA-37j2-3vv8-cf24 GHSA-jmvr-r5hm-fxfr
1 parent d670831 commit ff3233d

4 files changed

Lines changed: 269 additions & 72 deletions

File tree

‎advisories/github-reviewed/2026/05/GHSA-37j2-3vv8-cf24/GHSA-37j2-3vv8-cf24.json‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-37j2-3vv8-cf24",
4+
"modified": "2026-06-29T22:41:10Z",
5+
"published": "2026-05-26T13:30:15Z",
6+
"aliases": [
7+
"CVE-2026-5755"
8+
],
9+
"summary": "Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory",
10+
"details": "Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.. Mattermost Advisory ID: MMSA-2026-00648",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "11.6.0"
29+
},
30+
{
31+
"fixed": "11.6.1"
32+
}
33+
]
34+
}
35+
],
36+
"versions": [
37+
"11.6.0"
38+
]
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Go",
43+
"name": "github.com/mattermost/mattermost-server"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "11.5.0"
51+
},
52+
{
53+
"fixed": "11.5.4"
54+
}
55+
]
56+
}
57+
]
58+
},
59+
{
60+
"package": {
61+
"ecosystem": "Go",
62+
"name": "github.com/mattermost/mattermost-server"
63+
},
64+
"ranges": [
65+
{
66+
"type": "ECOSYSTEM",
67+
"events": [
68+
{
69+
"introduced": "11.4.0"
70+
},
71+
{
72+
"fixed": "11.4.5"
73+
}
74+
]
75+
}
76+
]
77+
},
78+
{
79+
"package": {
80+
"ecosystem": "Go",
81+
"name": "github.com/mattermost/mattermost-server"
82+
},
83+
"ranges": [
84+
{
85+
"type": "ECOSYSTEM",
86+
"events": [
87+
{
88+
"introduced": "10.11.0"
89+
},
90+
{
91+
"fixed": "10.11.15"
92+
}
93+
]
94+
}
95+
]
96+
}
97+
],
98+
"references": [
99+
{
100+
"type": "ADVISORY",
101+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5755"
102+
},
103+
{
104+
"type": "WEB",
105+
"url": "https://github.com/mattermost/mattermost/commit/d37c2d9d50b50963dabd92153adf7ed52016769a"
106+
},
107+
{
108+
"type": "PACKAGE",
109+
"url": "https://github.com/mattermost/mattermost"
110+
},
111+
{
112+
"type": "WEB",
113+
"url": "https://mattermost.com/security-updates"
114+
}
115+
],
116+
"database_specific": {
117+
"cwe_ids": [
118+
"CWE-400"
119+
],
120+
"severity": "MODERATE",
121+
"github_reviewed": true,
122+
"github_reviewed_at": "2026-06-29T22:41:10Z",
123+
"nvd_published_at": "2026-05-22T11:16:23Z"
124+
}
125+
}

‎advisories/github-reviewed/2026/05/GHSA-jmvr-r5hm-fxfr/GHSA-jmvr-r5hm-fxfr.json‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jmvr-r5hm-fxfr",
4+
"modified": "2026-06-29T22:41:48Z",
5+
"published": "2026-05-26T13:30:15Z",
6+
"aliases": [
7+
"CVE-2026-5308"
8+
],
9+
"summary": "Mattermost doesn't enforce request body size limits on plugin HTTP endpoints",
10+
"details": "Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints which allows an attacker to cause a denial of service via crafted oversized HTTP requests.. Mattermost Advisory ID: MMSA-2026-00646",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "11.6.0"
29+
},
30+
{
31+
"fixed": "11.6.1"
32+
}
33+
]
34+
}
35+
],
36+
"versions": [
37+
"11.6.0"
38+
]
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Go",
43+
"name": "github.com/mattermost/mattermost-server"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "11.5.0"
51+
},
52+
{
53+
"fixed": "11.5.4"
54+
}
55+
]
56+
}
57+
]
58+
},
59+
{
60+
"package": {
61+
"ecosystem": "Go",
62+
"name": "github.com/mattermost/mattermost-server"
63+
},
64+
"ranges": [
65+
{
66+
"type": "ECOSYSTEM",
67+
"events": [
68+
{
69+
"introduced": "11.4.0"
70+
},
71+
{
72+
"fixed": "11.4.5"
73+
}
74+
]
75+
}
76+
]
77+
},
78+
{
79+
"package": {
80+
"ecosystem": "Go",
81+
"name": "github.com/mattermost/mattermost-server"
82+
},
83+
"ranges": [
84+
{
85+
"type": "ECOSYSTEM",
86+
"events": [
87+
{
88+
"introduced": "10.11.0"
89+
},
90+
{
91+
"fixed": "10.11.15"
92+
}
93+
]
94+
}
95+
]
96+
},
97+
{
98+
"package": {
99+
"ecosystem": "Go",
100+
"name": "github.com/mattermost/mattermost-plugin-github"
101+
},
102+
"ranges": [
103+
{
104+
"type": "ECOSYSTEM",
105+
"events": [
106+
{
107+
"introduced": "0"
108+
},
109+
{
110+
"fixed": "1.0.1-0.20260410143745-9b41b1fd43c4"
111+
}
112+
]
113+
}
114+
]
115+
}
116+
],
117+
"references": [
118+
{
119+
"type": "ADVISORY",
120+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5308"
121+
},
122+
{
123+
"type": "WEB",
124+
"url": "https://github.com/mattermost/mattermost-plugin-github/commit/9b41b1fd43c408f4be53026ee337bbeaa74ad47c"
125+
},
126+
{
127+
"type": "PACKAGE",
128+
"url": "https://github.com/mattermost/mattermost"
129+
},
130+
{
131+
"type": "WEB",
132+
"url": "https://mattermost.com/security-updates"
133+
}
134+
],
135+
"database_specific": {
136+
"cwe_ids": [
137+
"CWE-400"
138+
],
139+
"severity": "HIGH",
140+
"github_reviewed": true,
141+
"github_reviewed_at": "2026-06-29T22:41:48Z",
142+
"nvd_published_at": "2026-05-22T11:16:23Z"
143+
}
144+
}

‎advisories/unreviewed/2026/05/GHSA-37j2-3vv8-cf24/GHSA-37j2-3vv8-cf24.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎advisories/unreviewed/2026/05/GHSA-jmvr-r5hm-fxfr/GHSA-jmvr-r5hm-fxfr.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

0 commit comments

Comments
 (0)