CVE-2026-11993

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the indexing of other files via uploading heavy files constantly to the server.. Mattermost Advisory ID: MMSA-2026-00696

Scoring

Severity

MEDIUM

CVSS base score

4.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS probability

0.21%

CWE

CWE-770

Published

2026-09-14

Last modified

2026-09-14

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-770

Related vulnerabilities

• CVE-2026-1168 — Allocation of Resources Without Limits or Throttling in GitLab
• CVE-2025-14871 — Allocation of Resources Without Limits or Throttling in GitLab
• CVE-2026-88878 — Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
• CVE-2026-82439 — Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
• CVE-2026-72684 — Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
• CVE-2026-74878 — openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass
• CVE-2026-77337 — CakePHP: Potential Authentication bypass with CookieAuthenticator
• CVE-2026-79921 — amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

Markdown version · Browse all CVEs