CVE-2026-19867: Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Q: Which deployments are affected?

Affected versions are Mattermost 11.10.0 and earlier 11.10.x releases, 11.9.1 and earlier 11.9.x releases, 11.8.5 and earlier 11.8.x releases, and 11.7.10 and earlier 11.7.x releases.

Q: What access does an attacker need?

An attacker needs an authenticated Mattermost account. They must share at least one channel with the members whose post processing they intend to affect.

Q: Is user interaction required to trigger the issue?

No. The issue is rated with no user interaction required; an authenticated user can store an oversized notify_props.mention_keys list on their own profile.

Q: What is the practical impact?

The issue can degrade post-processing latency and cause excessive CPU consumption when posts are processed for members sharing a channel with the attacker. The provided vector indicates availability impact only, with no confidentiality or integrity impact.

Published Oct 16, 2026

Updated

Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notifyprops.mentionkeys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773

Affected Software

1 affected component

Mattermost Mattermost<=11.10.0, <=11.9.1, <=11.8.5, <=11.7.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Mattermost to a version that resolves this vulnerability.
Fixed in 11.11.0Patch MMSA-2026-00773

Event History

Oct 16, 2026

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected versions are Mattermost 11.10.0 and earlier 11.10.x releases, 11.9.1 and earlier 11.9.x releases, 11.8.5 and earlier 11.8.x releases, and 11.7.10 and earlier 11.7.x releases.

What access does an attacker need?

An attacker needs an authenticated Mattermost account. They must share at least one channel with the members whose post processing they intend to affect.

Is user interaction required to trigger the issue?

No. The issue is rated with no user interaction required; an authenticated user can store an oversized notify_props.mention_keys list on their own profile.

What is the practical impact?

The issue can degrade post-processing latency and cause excessive CPU consumption when posts are processed for members sharing a channel with the attacker. The provided vector indicates availability impact only, with no confidentiality or integrity impact.

CVE-2026-19867: Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

Is user interaction required to trigger the issue?

What is the practical impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

Is user interaction required to trigger the issue?

What is the practical impact?