Executive brief
Mattermost is a team collaboration platform that allows users to post messages and attachments. This vulnerability lets authenticated users who can create posts craft specially formatted messages that trigger exponential computational overhead in the server's Markdown parser, causing CPU exhaustion and service degradation for all other users.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in Mattermost's Markdown parser, specifically in the autolink parsing logic. When processing Markdown autolinks with unmatched trailing closing parentheses, the regex engine enters catastrophic backtracking, consuming excessive CPU in non-linear time complexity. An authenticated user with permission to create posts can exploit this by submitting specially crafted post or message attachment content. The attack requires only post creation privileges and network access to the Mattermost instance. Patches are available in versions 11.9.1+, 11.8.5+, 11.7.8+, and 10.11.23+.
Affected products
- Mattermost Mattermost Server 11.9.0 and earlier, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22
Timeline
- 2026-09-14: disclosed
- 2026-09-14: advisory: Mattermost Advisory ID: MMSA-2026-00703