Executive brief
Mattermost, a popular enterprise collaboration and messaging platform, is vulnerable to a flaw that allows a user to crash the application for others. By posting a message with a specially crafted attachment, an attacker can cause the chat interface to freeze or become unresponsive for everyone in that channel. This disrupts team communications and requires users to restart or refresh their clients to regain access.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Mattermost client-side markdown parser due to inefficient regular expression complexity (CWE-1333). The application fails to properly validate the length and content of message attachment field values. An authenticated attacker can exploit this by sending a specially crafted payload in a post, which triggers catastrophic backtracking during parsing. This results in high CPU utilization on the client side, effectively causing a denial of service (DoS) for all users viewing the affected channel. The issue is resolved in versions 11.7.3, 11.6.5, 10.11.20, and 11.8.0.
Affected products
- Mattermost Mattermost 11.7.0 - 11.7.2, 11.6.0 - 11.6.4, 10.11.0 - 10.11.19
Timeline
- 2026-07-13: advisory
- 2026-07-13: disclosed