CVE-2026-11993
Received Received - Intake

Denial of Service in Mattermost via Excessive File Uploads

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the indexing of other files via uploading heavy files constantly to the server.. Mattermost Advisory ID: MMSA-2026-00696

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-10-04
AI Q&A
2026-09-14
EPSS Evaluated
2026-10-03
NVD
CVE-2026-11993
EUVD
EUVD-2026-77361

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mattermost mattermost to 11.9.0 (inc)
mattermost mattermost to 11.8.4 (inc)
mattermost mattermost to 11.7.7 (inc)
mattermost mattermost to 10.11.22 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Mattermost versions 11.9.0 and below, 11.8.4 and below, 11.7.7 and below, and 10.11.22 and below. It allows users with file upload permissions to create excessive goroutines by constantly uploading large files, which blocks the server from indexing other files properly.

Detection Guidance

This vulnerability involves excessive goroutine creation due to improper handling of file uploads. Detection requires monitoring server resource usage and goroutine counts during file upload operations. Check for elevated CPU/memory usage and blocked file indexing tasks when users upload large files repeatedly.

Impact Analysis

An attacker could exploit this to degrade server performance by consuming excessive resources, potentially causing denial-of-service conditions where legitimate users cannot upload or access files due to server overload.

Compliance Impact

The vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized resource consumption on the server, which may lead to degraded performance or denial of service. This could interfere with the availability of personal or sensitive data processing, a key requirement under both regulations.

Mitigation Strategies

Update Mattermost to a version that fixes the issue. Specifically, upgrade to versions beyond 11.9.0, 11.8.4, 11.7.7, or 10.11.22 depending on your current installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11993. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart