Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-11993 EUVD-2026-77361GHSA-rx7r-2mx7-mxq9

Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion

Published Sep 14, 2026 · Updated Sep 14, 2026 · Assigned by Mattermost

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the indexing of other files via uploading heavy files constantly to the server.. Mattermost Advisory ID: MMSA-2026-00696

Affected products

VendorProductAffectedFixed
Mattermost Mattermost 11.9.0 – ≤ 11.9.0, 11.8.0 – ≤ 11.8.4, 11.7.0 – ≤ 11.7.7, 10.11.0 – ≤ 10.11.22 11.10.0

References