CVE-2026-12882

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703

Scoring

Severity

MEDIUM

CVSS base score

4.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS probability

0.21%

CWE

CWE-407

Published

2026-09-14

Last modified

2026-09-14

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-407

Related vulnerabilities

• CVE-2022-36021 — Redis string pattern matching can be abused to achieve Denial of Service
• CVE-2026-34573 — Parse Server: GraphQL complexity validator exponential fragment traversal DoS
• CVE-2025-64460 — Potential denial-of-service vulnerability in XML serializer text extraction
• CVE-2025-64458 — Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
• CVE-2026-1285 — Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
• CVE-2025-14550 — Potential denial-of-service vulnerability via repeated headers when using ASGI
• CVE-2026-3276 — Potential DoS via quadratic complexity in unicodedata.normalize()
• CVE-2024-8233 — Inefficient Algorithmic Complexity in GitLab

Markdown version · Browse all CVEs