Nixpkgs security tracker

Untriaged

Permalink CVE-2026-4915

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 6 days, 20 hours ago Activity log

Created suggestion 6 days, 20 hours ago

Server panic via outgoing webhook responses

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry.. Mattermost Advisory ID: MMSA-2026-00641

References

MMSA-2026-00641 vendor-advisory

Affected products

Mattermost

==11.4.5
==10.11.15
==11.7.0
=<11.6.0
=<11.5.3
=<11.4.4
==11.5.4
==11.6.1
=<10.11.14

Matching in nixpkgs

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.6.1
- nixpkgs-unstable 11.7.0
- nixos-unstable-small 11.7.0
nixos-25.11 10.11.15
- nixos-25.11-small 10.11.17
- nixpkgs-25.11-darwin 10.11.17