Skip to main content

Mattermost CVE-2026-86349

| EUVDEUVD-2026-77480 MEDIUM
Inefficient Algorithmic Complexity (CWE-407)
2026-09-14 Mattermost GHSA-6mc8-c94m-mjg8
Denial Of Service Mattermost
4.3
CVSS 3.1 · Vendor: Mattermost
Share

Severity by source

Vendor (Mattermost) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
4.3 MEDIUM

Authenticated network user required (PR:L, AV:N); parser flaw needs no special conditions (AC:L); impact is availability-only, partial (A:L), with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

1
Analysis Generated
Sep 15, 2026 - 08:27 vuln.today

DescriptionCVE.org

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested blockquotes or list items.. Mattermost Advisory ID: MMSA-2026-00707

AnalysisAI

Mattermost's server-side Markdown parser across versions 10.11.x through 11.9.0 fails to enforce a nesting depth limit, allowing any authenticated user to cause CPU resource exhaustion by posting a message containing pathologically deep blockquote or list item nesting. The vulnerability is classified CWE-407 (Inefficient Algorithmic Complexity), producing a denial-of-service condition that degrades availability for all users of the affected instance. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires a valid, authenticated Mattermost user account with posting rights in at least one channel (CVSS PR:L confirmed by vendor). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) accurately reflects a constrained-impact scenario: network-reachable, low complexity, but requiring authenticated access (PR:L), with only partial availability impact and no confidentiality or integrity exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to the next patched release in each affected branch as specified by Mattermost advisory MMSA-2026-00707, available at https://mattermost.com/security-updates. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mattermost

View all
CVE-2025-25279 CRITICAL
9.9 Feb 24

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
CVE-2026-48801 HIGH POC
8.7 Jun 26

Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
CVE-2022-4044 MEDIUM POC
6.5 Nov 23

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
CVE-2022-3257 MEDIUM POC
6.5 Sep 23

Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
CVE-2025-4981 CRITICAL
9.9 Jun 20

A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
CVE-2025-20051 CRITICAL
9.9 Feb 24

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
CVE-2026-4858 CRITICAL
9.9 May 21

Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
CVE-2025-12421 CRITICAL
9.9 Nov 27

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
CVE-2025-12419 CRITICAL
9.9 Nov 27

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
CVE-2023-6458 CRITICAL
9.8 Dec 06

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
CVE-2020-26276 CRITICAL
9.8 Dec 17

Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
CVE-2025-24490 CRITICAL
9.6 Feb 24

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-90776 HIGH POC
8.7
CVE-2026-59094 HIGH POC
8.7
CVE-2026-71321 HIGH POC
7.5
CVE-2026-59887 HIGH POC
7.5
CVE-2026-73643 HIGH POC
7.5
CVE-2024-9631 HIGH POC
7.5
CVE-2026-27903 HIGH POC
7.5
CVE-2026-3988 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-86349 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy