Quick answers
- Is CVE-2026-6850 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-6850 being exploited in the wild.
- How severe is CVE-2026-6850?
- Medium severity, with a CVSS score of 6.5, published 13 July 2026.
- Which products and versions are affected?
- Mattermost 11.7.0 - 11.7.2, 11.6.0 - 11.6.4, 10.11.0 - 10.11.19.
- Is there a fix for CVE-2026-6850?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-6850 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-6850?
- Check whether you run Mattermost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Mattermost client-side markdown parser due to inefficient regular expression complexity (CWE-1333). The application fails to properly validate the length and content of message attachment field values. An authenticated attacker can exploit this by sending a specially crafted payload in a post, which triggers catastrophic backtracking during parsing. This results in high CPU utilization on the client side, effectively causing a denial of service (DoS) for all users viewing the affected channel. The issue is resolved in versions 11.7.3, 11.6.5, 10.11.20, and 11.8.0.
Affected products
- Mattermost Mattermost 11.7.0 - 11.7.2, 11.6.0 - 11.6.4, 10.11.0 - 10.11.19
Timeline
- 2026-07-13: advisory
- 2026-07-13: disclosed