CVE-2026-14298

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.. Mattermost Advisory ID: MMSA-2026-00713

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS probability

0.24%

CWE

CWE-409

Published

2026-08-13

Last modified

2026-08-13

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-409

Related vulnerabilities

• CVE-2026-46387 — Suricata http2: decompression bomb can cause denial of service in Suricata
• CVE-2026-79695 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
• CVE-2026-69304 — ASP.NET Core Denial of Service Vulnerability
• CVE-2026-85786 — Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
• CVE-2026-82520 — parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments
• CVE-2026-84382 — HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
• CVE-2026-78594 — Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service
• CVE-2026-72628 — Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service

Markdown version · Browse all CVEs