CVE-2026-6850: Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload that triggers catastrophic backtracking in the client-side markdown parser.. Mattermost Advisory ID: MMSA-2026-00658
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.3 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.5 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.20 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in higher
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6850?
The severity of CVE-2026-6850 is rated as medium with a score of 6.5.
How do I fix CVE-2026-6850?
To fix CVE-2026-6850, upgrade Mattermost to versions 11.7.3, 11.6.5, or 10.11.20 or later.
What impact does CVE-2026-6850 have?
CVE-2026-6850 allows authenticated attackers to cause a client-side denial of service for all users in a channel.
Which Mattermost versions are affected by CVE-2026-6850?
Mattermost versions 11.7.x up to 11.7.2, 11.6.x up to 11.6.4, and 10.11.x up to 10.11.19 are affected by CVE-2026-6850.
How does CVE-2026-6850 exploit vulnerability?
CVE-2026-6850 exploits the vulnerability by using crafted message attachment payloads that trigger regex backtracking in the markdown parser.