Volerion logoVolerion
Volerion logoVolerion

Mattermost Denial-of-Service Vulnerability via Unrate Limited Login Requests

Vulnerability

A denial-of-service vulnerability has been identified in Mattermost versions 11.4.x through 11.4.0, 11.3.x through 11.3.1, 11.2.x through 11.2.3, and 10.11.x through 10.11.11. The issue arises because these versions fail to properly rate limit login requests, allowing unauthenticated remote attackers to send over 100 parallel login requests. This unrate limited traffic can lead to a server crash and subsequent restart.

Impact

Exploitation of this vulnerability causes the Mattermost server to crash and restart, disrupting service availability.

Remediation

Users can upgrade to Mattermost versions 11.5.0 or 11.6.0 to address this vulnerability.

Added: Mar 25, 2026, 7:53 PM
Updated: Mar 25, 2026, 7:53 PM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
2.5
exploitability
7.0
remediation
7.7
relevance
4.7
threat
0.0
urgency
2.9
incentive
4.2

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.