What is the CVSS score of CVE-2026-6850?

CVE-2026-6850 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-6850

EUVD-2026-43313 MEDIUM

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-07-13 Mattermost

GHSA-c8hv-77r5-h5f7

Denial Of Service Mattermost

6.5

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-delivered post requires a low-privilege authenticated account (PR:L, AV:N); no confidentiality or integrity impact; availability is high as all channel members' clients are simultaneously affected.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 09:04 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload that triggers catastrophic backtracking in the client-side markdown parser.. Mattermost Advisory ID: MMSA-2026-00658

AnalysisAI

Catastrophic regex backtracking in Mattermost's client-side markdown parser can be triggered by an authenticated user posting a specially crafted message attachment, causing a denial-of-service condition for every user rendering that channel. Affected builds span versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the low exploitation complexity (AC:L, PR:L) lowers the bar for any authenticated insider or compromised account.

Technical ContextAI

CWE-1333 (Inefficient Regular Expression Complexity) is the root cause, classically known as ReDoS - Regular Expression Denial of Service. Mattermost fails to validate the length and content of message attachment field values before passing them to the client-side markdown parser. That parser relies on regular expressions that, when fed adversarially crafted input, exhibit exponential or near-exponential backtracking behavior, causing the regex engine to consume unbounded CPU time. Because rendering occurs client-side for every connected user viewing the affected channel, a single malicious post multiplies the impact across all channel members simultaneously. The affected product is identified under CPE cpe:2.3:a:mattermost:mattermost:* and the vulnerability is tied to Mattermost advisory MMSA-2026-00658.

RemediationAI

Upgrade to a patched Mattermost release as documented in vendor advisory MMSA-2026-00658, available at https://mattermost.com/security-updates. Exact patched version numbers were not included in the available intelligence data; consult the advisory directly to identify the correct fixed build for your active branch (11.7.x, 11.6.x, or 10.11.x). As a compensating control where immediate patching is not feasible, restricting Mattermost user registration and channel membership to verified, trusted accounts reduces the attacker pool, since exploitation requires an authenticated user with posting rights. Disabling or restricting the message attachment feature via the Mattermost System Console eliminates the specific attack surface at the cost of reduced post-formatting functionality. Rate-limiting or content-length-capping at the API layer for attachment field values may also reduce exploitability but should not be treated as a substitute for patching.