CVE-2026-15814

EUVD-2026-77369

14.09.2026, 11:17

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719

Data Amplification

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
Mattermost	CNA	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 36.28%

Affected Products (NVD)

Vendor	Product	Version
mattermost	mattermost_server	10.11.0 ≤ 𝑥 < 10.11.23
mattermost	mattermost_server	11.7.0 ≤ 𝑥 < 11.7.8
mattermost	mattermost_server	11.8.0 ≤ 𝑥 < 11.8.5
mattermost	mattermost_server	11.9.0 ≤ 𝑥 < 11.9.1

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
mattermost	mattermost	11.9.0	CNA
mattermost	mattermost	11.8.0 ≤ 𝑥 ≤ 11.8.4	CNA
mattermost	mattermost	11.7.0 ≤ 𝑥 ≤ 11.7.7	CNA
mattermost	mattermost	10.11.0 ≤ 𝑥 ≤ 10.11.22	CNA

Common Weakness Enumeration

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

References

https://mattermost.com/security-updates