CVE-2026-16251: Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response.. Mattermost Advisory ID: MMSA-2026-00726
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0Patch MMSA-2026-00726 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.1Patch MMSA-2026-00726 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.10Patch MMSA-2026-00726 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.2Patch MMSA-2026-00726 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.6Patch MMSA-2026-00726
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are Mattermost 11.10.0 and earlier 11.10.x releases, 11.7.9 and earlier 11.7.x releases, 11.9.1 and earlier 11.9.x releases, and 11.8.5 and earlier 11.8.x releases.
What does an attacker need to exploit this issue?
An attacker needs network access and low-privileged access to Mattermost. They can trigger the issue by causing a local image proxy direct fetch to retrieve a crafted oversized image response.
What is the likely impact of successful exploitation?
The remote image response can be buffered in server memory without a size limit, potentially exhausting available memory and causing a denial of service. The provided severity vector indicates no confidentiality or integrity impact.