CVE-2026-86349

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested blockquotes or list items.. Mattermost Advisory ID: MMSA-2026-00707

Scoring

Severity

MEDIUM

CVSS base score

4.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS probability

0.22%

CWE

CWE-407

Published

2026-09-14

Last modified

2026-09-14

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-407

Related vulnerabilities

• CVE-2022-36021 — Redis string pattern matching can be abused to achieve Denial of Service
• CVE-2026-34573 — Parse Server: GraphQL complexity validator exponential fragment traversal DoS
• CVE-2025-64460 — Potential denial-of-service vulnerability in XML serializer text extraction
• CVE-2025-64458 — Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
• CVE-2026-1285 — Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
• CVE-2025-14550 — Potential denial-of-service vulnerability via repeated headers when using ASGI
• CVE-2026-3276 — Potential DoS via quadratic complexity in unicodedata.normalize()
• CVE-2024-8233 — Inefficient Algorithmic Complexity in GitLab

Markdown version · Browse all CVEs