CVE-2026-19867: Uncapped mention keys in user notification properties allow CPU exhaustion during post processing
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notifyprops.mentionkeys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0Patch MMSA-2026-00773
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are Mattermost 11.10.0 and earlier 11.10.x releases, 11.9.1 and earlier 11.9.x releases, 11.8.5 and earlier 11.8.x releases, and 11.7.10 and earlier 11.7.x releases.
What access does an attacker need?
An attacker needs an authenticated Mattermost account. They must share at least one channel with the members whose post processing they intend to affect.
Is user interaction required to trigger the issue?
No. The issue is rated with no user interaction required; an authenticated user can store an oversized notify_props.mention_keys list on their own profile.
What is the practical impact?
The issue can degrade post-processing latency and cause excessive CPU consumption when posts are processed for members sharing a channel with the attacker. The provided vector indicates availability impact only, with no confidentiality or integrity impact.