CVE-2026-15814

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS probability

0.24%

CWE

CWE-409

Published

2026-09-14

Last modified

2026-09-14

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-409

Related vulnerabilities

• CVE-2025-66471 — urllib3 Streaming API improperly handles highly compressed data
• CVE-2026-22776 — cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb
• CVE-2026-5132 — Unbounded zlib decompression in Calls SDP WebSocket messages
• CVE-2026-14298 — Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost
• CVE-2026-10819 — Mattermost Server Denial of Service via Animated GIF Emoji Upload
• CVE-2026-21441 — urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
• CVE-2024-7765 — Denial of Service in h2oai/h2o-3
• CVE-2024-3572 — XML External Entity (XXE) Vulnerability in scrapy/scrapy

Markdown version · Browse all CVEs