CVE-2026-86349: Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested blockquotes or list items.. Mattermost Advisory ID: MMSA-2026-00707
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 11.10.0 - Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 11.9.1 - Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 11.8.5 - Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 11.7.9 - Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 10.11.23
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Mattermost and able to submit a crafted post. The impact is CPU resource exhaustion that can cause a denial of service.
Which Mattermost releases are affected?
Affected releases are Mattermost 11.9.0 and earlier in the 11.9.x line, 11.8.4 and earlier in 11.8.x, 11.7.8 and earlier in 11.7.x, and 10.11.22 and earlier in 10.11.x.
What content triggers the resource exhaustion?
The attacker posts Markdown containing deeply nested blockquotes or list items. The server-side Markdown parser does not limit nesting depth, allowing excessive CPU consumption during parsing.