CVE-2026-8683: Overly long URLs crash the Mattermost Desktop App
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermost Desktop Appto a version that resolves this vulnerability.Fixed in 6.2.0 - Upgrade
Upgrade
Mattermost Desktop Appto a version that resolves this vulnerability.Fixed in 5.13.6.0 - Compensating control
Until upgraded, avoid opening externally controlled/unknown links in the Mattermost Desktop App to reduce the chance of triggering the long-URL crash scenario described in MMSA-2026-00652.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8683?
The severity of CVE-2026-8683 is rated as medium with a score of 6.5.
How do I fix CVE-2026-8683?
To fix CVE-2026-8683, update the Mattermost Desktop App to version 6.2 or later.
What versions of Mattermost are affected by CVE-2026-8683?
Mattermost Desktop App versions 6.1 and 5.5.13.0 are affected by CVE-2026-8683.
What type of attack does CVE-2026-8683 enable?
CVE-2026-8683 enables an attack that allows a malicious server owner to crash the Mattermost Desktop App.
What can attackers exploit in CVE-2026-8683?
Attackers can exploit CVE-2026-8683 by including a script that calls window.open with an overly long URL.