CVE-2026-10600

MEDIUM

Denial of service via unbounded document content extraction in Mattermost Server

Title source: cna
STIX 2.1

Description

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.. Mattermost Advisory ID: MMSA-2026-00694

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
MMSA-2026-00694
https://mattermost.com/security-updates

Scores

CVSS v3 4.3
EPSS 0.0021
EPSS Percentile 11.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-770
Status published
Products (9)
Mattermost/Mattermost 10.11.0 - 10.11.20
Mattermost/Mattermost 10.11.21
Mattermost/Mattermost 11.6.0 - 11.6.5
Mattermost/Mattermost 11.6.6
Mattermost/Mattermost 11.7.0 - 11.7.3
Mattermost/Mattermost 11.7.4
Mattermost/Mattermost 11.8.0
Mattermost/Mattermost 11.8.1
Mattermost/Mattermost 11.9.0
Published Jul 27, 2026
Tracked Since Jul 27, 2026