CVE-2026-86349
Received Received - Intake

Denial of Service in Mattermost via Deeply Nested Markdown

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested blockquotes or list items.. Mattermost Advisory ID: MMSA-2026-00707

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-86349
EUVD
EUVD-2026-77480

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mattermost mattermost to 11.9.0 (inc)
mattermost mattermost to 11.8.4 (inc)
mattermost mattermost to 11.7.8 (inc)
mattermost mattermost to 10.11.22 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Mattermost versions 11.9.0 and below, 11.8.4 and below, 11.7.8 and below, and 10.11.22 and below. It involves the server-side Markdown parser failing to limit nesting depth in blockquotes or list items, allowing an authenticated attacker to cause CPU resource exhaustion through a denial of service attack.

Detection Guidance

This vulnerability involves excessive nesting in Markdown posts causing CPU exhaustion. To detect it, monitor for unusually high CPU usage on Mattermost servers during user interactions. Check server logs for posts with deeply nested blockquotes or list items. No specific commands are provided in the available context.

Impact Analysis

If exploited, this vulnerability can lead to high CPU usage, slowing down or crashing the Mattermost server. This disrupts normal operations and may cause service outages for users.

Compliance Impact

This vulnerability causes CPU resource exhaustion via crafted posts, which could disrupt system availability. For GDPR, this may impact availability requirements under Article 32. For HIPAA, it could affect access controls and audit mechanisms if systems become unresponsive.

Mitigation Strategies

Upgrade Mattermost to a version higher than 11.9.0, 11.8.4, 11.7.8, or 10.11.22 to address the Markdown parser vulnerability. Apply patches as soon as possible to prevent CPU resource exhaustion from crafted posts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86349. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart