CVEvulnerability

CVE-2026-15814

6.5 MEDIUM Published 2026-09-14 Modified 2026-10-07 Official page ↗
Status
Analyzed
Published
2026-09-14
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-409

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719

Affected configurations

• mattermost mattermost server (>= 10.11.0 < 10.11.23) • mattermost mattermost server (>= 11.7.0 < 11.7.8) • mattermost mattermost server (>= 11.8.0 < 11.8.5) • mattermost mattermost server (>= 11.9.0 < 11.9.1)

Related

Weakness · CWE (1)

  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) weakness

References