CVE-2026-86349

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost versions 11.8.x through 11.8.4 Mattermost versions 11.7.x through 11.7.8 Mattermost versions 10.11.x through 10.11.22

Description The server-side Markdown parser fails to limit nesting depth. This allows an authenticated attacker to cause a denial of service through CPU resource exhaustion by submitting a crafted post containing deeply nested list items or blockquotes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.