CVE-2026-10600: Denial of service via unbounded document content extraction in Mattermost Server
Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.. Mattermost Advisory ID: MMSA-2026-00694
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch MMSA-2026-00694 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.9.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.8.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.7.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.6.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.11.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10600?
CVE-2026-10600 has a medium severity rating of 4.3.
How do I fix CVE-2026-10600?
To fix CVE-2026-10600, upgrade Mattermost Server to a version that is not affected, specifically 11.8.1 or later.
What does CVE-2026-10600 affect?
CVE-2026-10600 affects Mattermost Server versions 11.8.x up to 11.8.0, 11.7.x up to 11.7.3, 11.6.x up to 11.6.5, and 10.11.x up to 10.11.20.
What is the risk associated with CVE-2026-10600?
The risk associated with CVE-2026-10600 includes potential denial of service due to unbounded document content extraction.
Who is affected by CVE-2026-10600?
Authenticated users with file-upload permissions can exploit CVE-2026-10600 to degrade file uploads for all users on the server.