---
id: CVE-2026-5132
title: >-
  Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7,
  10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed
  with zlib, which allows attacker to deny service or crash server via sending
  many SDP me…
summary: >-
  Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7,
  10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed
  with zlib, which allows attacker to deny service or crash server via sending
  many SDP me…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-409
vendor: Mattermost
product: Mattermost
affected:
  - Mattermost >= 11.9.0 <= 11.9.0
  - Mattermost >= 11.8.0 <= 11.8.4
  - Mattermost >= 11.7.0 <= 11.7.7
  - Mattermost >= 10.11.0 <= 10.11.22
published: '2026-09-14'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:30:49.967'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5132'
references:
  - url: 'https://mattermost.com/security-updates'
    label: responsibledisclosure@mattermost.com
tags:
  - nvd
  - cve.org
epss: 0.00411
epssPercentile: 0.32637
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T11:03:03.373134Z'
ingestedAt: '2026-09-14T15:23:07.462Z'
---

## Overview

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.