Description
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested blockquotes or list items.. Mattermost Advisory ID: MMSA-2026-00707
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 11.9.0 – ≤ 11.9.0, 11.8.0 – ≤ 11.8.4, 11.7.0 – ≤ 11.7.8, 10.11.0 – ≤ 10.11.22 | 11.10.0 |
Advisories 1
- WID-SEC-2026-3361 Mattermost Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 14, 2026
References
- MMSA-2026-00707 vendor-advisory