Deserialization of Untrusted Data The advisory has been revoked - it doesn't affect any version of package mattermost-11.4 (opens in a new tab)

Threat Intelligence

0.68% (52^nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-WOLFILATEST-MATTERMOST114-18860529
published16 Aug 2026
disclosed22 May 2026

Report a new vulnerability Found a mistake?

Introduced: 22 May 2026

CVE-2026-39832 (opens in a new tab) CWE-502 (opens in a new tab)

Amendment

The Wolfi security team deemed this advisory irrelevant for Wolfi:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mattermost-11.4 package and not the mattermost-11.4 package as distributed by Wolfi.

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.