CVE-2026-10819
Received Received - Intake

Denial of Service via Animated GIF Upload in Mattermost

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom emoji.. Mattermost Advisory ID: MMSA-2026-00695

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-10819
EUVD
EUVD-2026-49254

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mattermost mattermost to 11.6.5 (inc)
mattermost mattermost to 10.11.20 (inc)
mattermost mattermost to 11.8.1 (inc)
mattermost mattermost to 11.7.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Mattermost versions between 11.6.0 and 11.6.5, 10.11.0 and 10.11.20, 11.8.0 and 11.8.1, and 11.7.0 and 11.7.4. It allows an authenticated attacker to upload a crafted animated GIF as a custom emoji that bypasses file size and frame limits, causing a denial of service.

Detection Guidance

Detecting this vulnerability requires checking Mattermost server logs for unusually large or frequent animated GIF uploads. Monitor for custom emoji uploads exceeding normal file size limits or rapid successive uploads that could indicate exploitation attempts.

Impact Analysis

An attacker could exploit this to crash the Mattermost server by uploading a maliciously crafted GIF, disrupting service for all users. This requires authentication but could lead to downtime and loss of availability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through resource exhaustion. GDPR requires data protection measures to ensure availability, while HIPAA mandates safeguards against unauthorized resource consumption. The lack of file size and frame limits on animated GIF uploads may lead to system instability, disrupting service availability and potentially violating these regulations.

Mitigation Strategies

Upgrade Mattermost to a version that fixes the vulnerability. Specifically, update to versions 11.6.6, 10.11.21, 11.7.5, or 11.8.2 or later to address the animated GIF upload issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10819. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart