Go/github.com/mattermost/mattermost/server/v8 CVE-2026-5740: high 7.5, EPSS 0.57%

Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

Action: Upgrade github.com/mattermost/mattermost/server/v8 to 8.0.0-20260410202636-17939826efa2 or later.

go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260410202636-17939826efa2

Affected

Fixed versions

Sources

• osv: GHSA-w9m8-p4cc-4qj9#Go/github.com/mattermost/mattermost/server/v8
• https://nvd.nist.gov/vuln/detail/CVE-2026-5740
• https://github.com/mattermost/mattermost/commit/17939826efa20a97f087b3d390ec5136df350bae
• https://github.com/mattermost/mattermost
• https://mattermost.com/security-updates

CVE-2026-5740 · published 2026-05-26T13:30:15Z · modified 2026-07-07T16:11:10.343209548Z · JSON