CVE-2026-4635 — Persistent notification timing attack causing server denial of service

Back Back to CVE browser

MEDIUM

Persistent notification timing attack causing server denial of service

Published May 22, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.29%

Description

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notifications which allows authenticated user to crash the server via timing the creation of persistent notification message between the server deleting existing persistent notifications and archiving the channel.. Mattermost Advisory ID: MMSA-2026-00637

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
- Version
  10.11.0
  Status
  affected
  Constraints
  <=10.11.14
- Version
  11.4.0
  Status
  affected
  Constraints
  <=11.4.4
- Version
  11.5.0
  Status
  affected
  Constraints
  <=11.5.3
- Version
  11.6.0
  Status
  affected
  Constraints
  <=11.6.0
- Version
  10.11.15
  Status
  unaffected
  Constraints
  -
- Version
  11.4.5
  Status
  unaffected
  Constraints
  -
- Version
  11.5.4
  Status
  unaffected
  Constraints
  -
- Version
  11.6.1
  Status
  unaffected
  Constraints
  -
- Version
  11.7.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mattermost

unaffected

Version	Status	Constraints
10.11.0	affected	<=10.11.14
11.4.0	affected	<=11.4.4
11.5.0	affected	<=11.5.3
11.6.0	affected	<=11.6.0
10.11.15	unaffected	-
11.4.5	unaffected	-
11.5.4	unaffected	-
11.6.1	unaffected	-
11.7.0	unaffected	-

github.com/mattermost/mattermost-server

Go

Introduced 10.11.0+incompatible Fixed 10.11.15+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 11.4.0+incompatible Fixed 11.4.5+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 11.5.0+incompatible Fixed 11.5.4+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 11.6.0+incompatible Fixed 11.6.1+incompatible

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost-server	10.11.0+incompatible	10.11.15+incompatible
Go	github.com/mattermost/mattermost-server	11.4.0+incompatible	11.4.5+incompatible
Go	github.com/mattermost/mattermost-server	11.5.0+incompatible	11.5.4+incompatible
Go	github.com/mattermost/mattermost-server	11.6.0+incompatible	11.6.1+incompatible

Remediation

Vendor solution

Update Mattermost to versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, 10.11.15 or higher.

Metrics

0.29% 0.00286

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00286

Score over time

May–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.29% (0.00286)	19.04th	v5 (v2026.06.15)
Jun 15, 2026	0.17% (0.00172)	6.82th	v5 (v2026.06.15)
May 22, 2026	0.04% (0.00036)	10.86th	v4 (v2025.03.14)

Weaknesses (1)

CWE-362

Race Condition

References (3)

https://github.com/advisories/GHSA-pg7c-462j-grxv
Advisory
https://mattermost.com/security-updates
vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4635

Link	Providers	Tags
https://github.com/advisories/GHSA-pg7c-462j-grxv		Advisory
https://mattermost.com/security-updates		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4635