CVE-2026-6850

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.2 Mattermost versions 11.6.0 through 11.6.4 Mattermost versions 10.11.0 through 10.11.19

Description An authenticated attacker can cause a denial of service for all users in a channel by creating a post with a specially crafted payload. The issue occurs because the software fails to validate the length and content of message attachment field values, which triggers catastrophic backtracking in the client-side markdown parser. Catastrophic backtracking is a condition where a regular expression engine takes an exponential amount of time to process a string, leading to system hangs or crashes.

Recommendations Update Mattermost versions 11.7.0 through 11.7.2 to a version newer than 11.7.2. Update Mattermost versions 11.6.0 through 11.6.4 to a version newer than 11.6.4. Update Mattermost versions 10.11.0 through 10.11.19 to a version newer than 10.11.19.