# CVE-2026-10600: Mattermost resource exhaustion in document content extraction

Source: https://junglewise.ai/threats/cve-2026-10600-mattermost-resource-exhaustion-in-document-content-extraction  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-10600 · Severity: medium · CVSS 4.3 · Published 2026-07-27

Mattermost is a collaboration platform used for team communication and file sharing. A vulnerability in how the server processes uploaded documents allows a malicious user to slow down or block file uploads for everyone else on the server. By repeatedly uploading specially crafted small files that are difficult for the server to process, an attacker can exhaust the system's resources, leading to a partial service disruption.

Technologies: [Mattermost](https://junglewise.ai/threats/technologies/mattermost). Vendors: [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-10600 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10600 being exploited in the wild.

**How severe is CVE-2026-10600?** Medium severity, with a CVSS score of 4.3, published 27 July 2026.

**Which products and versions are affected?** Mattermost 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20.

**Is there a fix for CVE-2026-10600?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10600 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10600?** Check whether you run Mattermost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) within the server-side document content extraction component. An authenticated attacker with file-upload permissions can exploit this by repeatedly uploading small documents that are computationally expensive to extract. This activity saturates the shared extraction worker pool, leading to a denial-of-service (DoS) condition specifically affecting the file upload functionality for all users. The issue is resolved in Mattermost versions 11.9.0, 11.8.1, 11.7.4, 11.6.6, and 10.11.21.

## Affected products

- Mattermost Mattermost 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20

## Timeline

- 2026-07-27: advisory: MMSA-2026-00694 published by Mattermost
- 2026-07-27: disclosed: CVE-2026-10600 published to NVD

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost permission bypass in board creation](https://junglewise.ai/threats/cve-2026-14344-mattermost-permission-bypass-in-board-creation)
- [Mattermost privilege escalation via BoardMember.Scheme validation bypass](https://junglewise.ai/threats/cve-2026-9816-mattermost-privilege-escalation-via-boardmember-scheme-validation)
- [Mattermost path traversal in file deletion endpoint](https://junglewise.ai/threats/cve-2026-7521-mattermost-path-traversal-in-file-deletion-endpoint)
- [Mattermost authorization bypass in Playbook metric configuration](https://junglewise.ai/threats/cve-2026-6541-mattermost-authorization-bypass-in-playbook-metric-configuration)
- [Mattermost ReDoS in client-side markdown parser](https://junglewise.ai/threats/cve-2026-6850-mattermost-redos-in-client-side-markdown-parser)