Mattermost CVE-2026-16251

Exploitation requires that the Mattermost local image proxy performing direct remote image fetches is in use, and that an authenticated user (PR:L) can cause the server to proxy-fetch a remote image from an attacker-controlled endpoint; the attacker then returns an oversized image response that is buffered in memory without a size limit. Limiting factors: a valid low-privilege account is required (not fully unauthenticated), the server must be configured to perform direct image-proxy fetches of remote images, and the instance must run an affected version (11.7.x≤11.7.9, 11.8.x≤11.8.5, 11.9.x≤11.9.1, or 11.10.x≤11.10.0). Impact is limited to availability (server memory exhaustion); no data disclosure or modification occurs.

This is a moderate-severity availability issue (CVSS 6.5) rather than a top-tier priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates a network-reachable, low-complexity attack requiring low privileges (PR:L = an authenticated user) with no user interaction, impacting availability only (A:H) with no confidentiality or integrity effect - consistent with CWE-770 uncontrolled resource consumption leading to memory exhaustion. No EPSS score, KEV listing, or POC was provided in the input; per precision rules this means no public exploit has been identified at time of analysis, and there is no evidence of active exploitation. The practical risk is a denial-of-service against the Mattermost server, not data compromise. The PR:L requirement meaningfully limits exposure to actors who hold valid (even low-privilege) accounts, so internet-facing but authentication-gated instances face a lower real-world threat than the network attack vector alone suggests. Overall this is a legitimate but non-urgent patching priority: credible, vendor-reported, and trivially triggerable by any authenticated user, but bounded to availability impact with no confirmed exploitation.

An authenticated user on a vulnerable Mattermost server posts or triggers a link that causes the server's local image proxy to directly fetch a remote image from an attacker-controlled host. The attacker's server returns a crafted, oversized image response that Mattermost buffers entirely in memory, exhausting server RAM and degrading or crashing the service. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or conditions are needed once the proxy fetch is invoked.