Executive brief
Mattermost, a collaboration and messaging platform, is vulnerable to a denial-of-service attack. An authenticated user can upload a specially crafted 7zip archive that causes the server to consume excessive memory during processing. This can lead to server instability or a complete service outage, disrupting business communications.
Technical details
A resource exhaustion vulnerability (CWE-789) exists in Mattermost's 'docextractor' service. The component fails to validate the internal structure of 7zip archives before processing them. An authenticated attacker can exploit this by uploading a 7zip file containing excessive folder declarations, which triggers large memory allocations during the extraction/indexing phase. This leads to server memory exhaustion and a denial-of-service (DoS) condition. The fix involves disabling 7zip decompression within the docextractor service and improving file type detection. Patches are available in versions 11.5.2, 11.4.4, and 10.11.14.
Affected products
- Mattermost Mattermost Server 11.5.0 - 11.5.1, 11.4.0 - 11.4.3, 10.11.0 - 10.11.13, < 8.0.0-20260325191733-fb11968f8798
Timeline
- 2026-05-18: disclosed
- 2026-05-18: advisory
- 2026-06-01: patched