CVE-2026-10819

Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom emoji.. Mattermost Advisory ID: MMSA-2026-00695

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS probability

0.24%

CWE

CWE-409

Published

2026-07-27

Last modified

2026-07-27

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-409

Related vulnerabilities

• CVE-2026-79695 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
• CVE-2026-69304 — ASP.NET Core Denial of Service Vulnerability
• CVE-2026-85786 — Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
• CVE-2026-82520 — parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments
• CVE-2026-84382 — HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
• CVE-2026-78594 — Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service
• CVE-2026-72628 — Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service
• CVE-2026-82864 — pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

Markdown version · Browse all CVEs