CVE-2026-14298

Modified Modified - Updated After Analysis

Denial of Service in Mattermost

Publication date: 2026-08-13

Last updated on: 2026-09-14

Assigner: Mattermost, Inc.

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.. Mattermost Advisory ID: MMSA-2026-00713

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-09-14

Generated

2026-09-22

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-21

NVD

CVE-2026-14298

EUVD

EUVD-2026-57742

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_server	From 10.11.0 (inc) to 10.11.23 (exc)
mattermost	mattermost_server	From 11.7.0 (inc) to 11.7.8 (exc)
mattermost	mattermost_server	From 11.8.0 (inc) to 11.8.5 (exc)
mattermost	mattermost_server	From 11.9.0 (inc) to 11.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

Mattermost versions between 11.9.0 and earlier, 11.8.4 and earlier, 11.7.7 and earlier, and 10.11.22 and earlier fail to properly limit resource consumption when processing certain user-supplied input. This allows an authenticated user to cause a denial of service by consuming excessive server resources.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. Monitoring for unusual resource consumption or denial of service events in Mattermost applications may be necessary.

Impact Analysis

An authenticated attacker could exploit this to disrupt service availability by overloading the server with resource-intensive requests, leading to degraded performance or complete downtime for all users.

Compliance Impact

This vulnerability allows an authenticated user to cause a denial of service by consuming excessive resources, which could disrupt system availability. For GDPR, this may impact the right to access services reliably. For HIPAA, it could affect the availability of critical systems handling protected health information.

Mitigation Strategies

Update Mattermost to a version that fixes this issue. Based on the advisory, versions 11.9.0, 11.8.4, 11.7.7, and 10.11.22 or later should address the vulnerability.

Hi! I’m here to help you understand CVE-2026-14298. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70