CVE-2026-19867
Received Received - Intake

Denial of Service in Mattermost via Oversized Mention Keys

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-19867
EUVD
EUVD-2026-102808

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Mattermost Mattermost 11.10.0
Mattermost Mattermost 11.9.0
Mattermost Mattermost 11.8.0
Mattermost Mattermost 11.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Mattermost versions between 11.7.10 and 11.10.0. It allows an authenticated user to store an excessively large list of mention keys in their notification properties. When processing posts, the system performs inefficient multibyte-keyword matching that scales quadratically with the size of this list, causing high CPU usage and degraded performance for all users in shared channels.

Detection Guidance

The CVE describes an issue in Mattermost where oversized notify_props.mention_keys lists cause excessive CPU usage. Detection requires checking Mattermost server logs for high CPU usage during post-processing and inspecting user profiles for unusually large mention_keys values. No specific commands are provided in the CVE details.

Impact Analysis

If exploited, this vulnerability can slow down post-processing for all users in channels shared with the attacker. It may cause system lag, unresponsive interfaces, or increased server load, potentially disrupting normal operations for teams relying on Mattermost.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service conditions through excessive CPU consumption, potentially disrupting availability of systems processing personal or health data. However, the CVE description does not explicitly link this issue to compliance requirements.

Mitigation Strategies

Upgrade Mattermost to a version that fixes this issue. Specifically, update to versions beyond 11.10.0, 11.9.1, 11.8.5, or 11.7.10 depending on your current installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart