Executive brief
Mattermost servers fail to properly limit the number of concurrent file uploads and processing tasks, allowing authenticated users to exhaust system resources by uploading large files repeatedly. This prevents the server from indexing legitimate files and can degrade performance for all users sharing the same deployment.
Technical details
A resource exhaustion vulnerability in Mattermost file handling fails to enforce concurrency limits on goroutines spawned during file upload and indexing operations. An authenticated user with file upload permissions can repeatedly upload large or deliberately malicious files to exhaust the thread pool, causing subsequent file indexing operations to stall or fail. The vulnerability affects Mattermost Server versions 11.9.0, 11.8.4, 11.7.7, and 10.11.22 and earlier in their respective release branches. Attack requires file upload permissions and network access to the Mattermost server. Patches are available in newer releases of affected version branches.
Affected products
- Mattermost Mattermost Server 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22
Timeline
- 2026-09-14: disclosed