CVE-2026-6850

MediumCVSS 6.5/10Last modified Jul 13, 2026

Description

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload that triggers catastrophic backtracking in the client-side markdown parser.. Mattermost Advisory ID: MMSA-2026-00658

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2026
Last modified: Jul 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-685007.5Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's P CVE-2026-685016.5Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's G CVE-2026-685029.8LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unau CVE-2026-685039.8LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials CVE-2026-685087.8Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python obj CVE-2026-68517.0An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Sec CVE-2026-685137.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3 CVE-2026-685145.5OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In vers CVE-2026-685157.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions CVE-2026-685166.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version CVE-2026-685176.5Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_a CVE-2026-685188.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes i