Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry. Mattermost Advisory ID: MMSA-2026-00641
Update github.com/mattermost/mattermost-server to 11.6.1; github.com/mattermost/mattermost-server to 11.5.4; github.com/mattermost/mattermost-server to 11.4.5; github.com/mattermost/mattermost-server to 10.11.15; github.com/mattermost/mattermost/server/v8 to 8.0.0-20260407102538-faa7d75b4ea0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanMattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing affects github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost/server/v8 (go). Severity is medium. Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry. Mattermost Advisory ID: MMSA-2026-00641
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range |
|---|
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry. Mattermost Advisory ID: MMSA-2026-00641
Update github.com/mattermost/mattermost-server to 11.6.1; github.com/mattermost/mattermost-server to 11.5.4; github.com/mattermost/mattermost-server to 11.4.5; github.com/mattermost/mattermost-server to 10.11.15; github.com/mattermost/mattermost/server/v8 to 8.0.0-20260407102538-faa7d75b4ea0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanMattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing affects github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost/server/v8 (go). Severity is medium. Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry. Mattermost Advisory ID: MMSA-2026-00641
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range |
|---|
| Fixed version |
|---|
| github.com/mattermost/mattermost-servergo | =11.6.0 | 11.6.1 |
|---|---|---|
| github.com/mattermost/mattermost-servergo | >=11.5.0,<11.5.4 | 11.5.4 |
| github.com/mattermost/mattermost-servergo | >=11.4.0,<11.4.5 | 11.4.5 |
| github.com/mattermost/mattermost-servergo | >=10.11.0,<10.11.15 | 10.11.15 |
| github.com/mattermost/mattermost/server/v8go | <8.0.0-20260407102538-faa7d75b4ea0 | 8.0.0-20260407102538-faa7d75b4ea0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Fixed version |
|---|
| github.com/mattermost/mattermost-servergo | =11.6.0 | 11.6.1 |
|---|---|---|
| github.com/mattermost/mattermost-servergo | >=11.5.0,<11.5.4 | 11.5.4 |
| github.com/mattermost/mattermost-servergo | >=11.4.0,<11.4.5 | 11.4.5 |
| github.com/mattermost/mattermost-servergo | >=10.11.0,<10.11.15 | 10.11.15 |
| github.com/mattermost/mattermost/server/v8go | <8.0.0-20260407102538-faa7d75b4ea0 | 8.0.0-20260407102538-faa7d75b4ea0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard