CVE-2026-86349: Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting

Published Sep 14, 2026
·
Updated

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested blockquotes or list items.. Mattermost Advisory ID: MMSA-2026-00707

Affected Software

4 affected components
Mattermost Mattermost Server>11.9.0<=11.9.0
Mattermost Mattermost Server>11.8.0<=11.8.4
Mattermost Mattermost Server>11.7.0<=11.7.8
Mattermost Mattermost Server>10.11.0<=10.11.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Mattermost Server to a version that resolves this vulnerability.

    Fixed in 11.10.0
  2. Upgrade

    Upgrade Mattermost Server to a version that resolves this vulnerability.

    Fixed in 11.9.1
  3. Upgrade

    Upgrade Mattermost Server to a version that resolves this vulnerability.

    Fixed in 11.8.5
  4. Upgrade

    Upgrade Mattermost Server to a version that resolves this vulnerability.

    Fixed in 11.7.9
  5. Upgrade

    Upgrade Mattermost Server to a version that resolves this vulnerability.

    Fixed in 10.11.23

Event History

Sep 14, 2026
CVE Published
via MITRE·01:51 PM
Data Sourced
via MITRE·01:51 PM
RemedyDescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

An attacker must be authenticated to Mattermost and able to submit a crafted post. The impact is CPU resource exhaustion that can cause a denial of service.

2

Which Mattermost releases are affected?

Affected releases are Mattermost 11.9.0 and earlier in the 11.9.x line, 11.8.4 and earlier in 11.8.x, 11.7.8 and earlier in 11.7.x, and 10.11.22 and earlier in 10.11.x.

3

What content triggers the resource exhaustion?

The attacker posts Markdown containing deeply nested blockquotes or list items. The server-side Markdown parser does not limit nesting depth, allowing excessive CPU consumption during parsing.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203