CVE-2026-6850

MediumCVSS 6.5/10Last modified Jul 13, 2026

Description

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload that triggers catastrophic backtracking in the client-side markdown parser.. Mattermost Advisory ID: MMSA-2026-00658

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.7.0, <= 11.7.2; >= 11.6.0, <= 11.6.4; >= 10.11.0, <= 10.11.19

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Jul 13, 2026
Last modified: Jul 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-685007.5Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's P CVE-2026-685016.5Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's G CVE-2026-685029.8LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unau CVE-2026-685039.8LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials CVE-2026-685076.9ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forward CVE-2026-685087.8Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python obj CVE-2026-685096.3FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not ade CVE-2026-68517.0An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Sec CVE-2026-685106.9bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs deserialize from an untrusted s CVE-2026-685116.3Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concur CVE-2026-685126.3Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, an CVE-2026-685137.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3