Executive brief
Mattermost Server is a team collaboration platform used for messaging and project coordination across organizations. A denial-of-service vulnerability in its Markdown parser allows authenticated users to crash or severely slow the server by posting messages with deeply nested blockquotes or lists, consuming excessive CPU resources and potentially disrupting service availability for all users.
Technical details
The vulnerability exists in the server-side Markdown parser, which fails to enforce a limit on nesting depth for Markdown constructs such as blockquotes and list items. An authenticated attacker can craft a malicious post containing deeply nested structures that cause excessive computational work during parsing, leading to CPU resource exhaustion and denial of service. The attack requires authentication but no additional preconditions beyond the ability to post messages. An attacker can achieve temporary service degradation or unavailability. Patches are available in fixed versions: 11.9.1+, 11.8.5+, 11.7.9+, and 10.11.23+.
Affected products
- Mattermost Mattermost Server 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22
Timeline
- 2026-09-14: disclosed