Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-12882

Mattermost Markdown autolink parsing denial of service

CVSS 3.1 4.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-12882

Published

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-12882

Published

Mattermost

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "Mattermost",
                    "vendor": "Mattermost",
                    "versions": [
                        {
                            "lessThanOrEqual": "11.9.0",
                            "status": "affected",
                            "version": "11.9.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThanOrEqual": "11.8.4",
                            "status": "affected",
                            "version": "11.8.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThanOrEqual": "11.7.7",
                            "status": "affected",
                            "version": "11.7.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThanOrEqual": "10.11.22",
                            "status": "affected",
                            "version": "10.11.0",
                            "versionType": "semver"
                        },
                        {
                            "version": "11.10.0",
                            "status": "unaffected"
                        },
                        {
                            "version": "11.9.1",
                            "status": "unaffected"
                        },
                        {
                            "version": "11.8.5",
                            "status": "unaffected"
                        },
                        {
                            "version": "11.7.8",
                            "status": "unaffected"
                        },
                        {
                            "version": "10.11.23",
                            "status": "unaffected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON