CVE-2026-12882: Mattermost Markdown autolink parsing denial of service

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-14 · updated 2026-10-07
Weakness: CWE-407

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703

Affected products

Mattermost: from 10.11.0 before 10.11.23; from 11.7.0 before 11.7.8; from 11.8.0 before 11.8.5; from 11.9.0 before 11.9.1 — fixed in 10.11.23, 11.7.8, 11.8.5, 11.9.1

How to fix

Upgrade to a fixed version: Mattermost 10.11.23, 11.7.8, 11.8.5, 11.9.1. Check the vendor advisory for mitigations.

References

https://mattermost.com/security-updates

Get alerted when CVE-2026-12882 or the next vulnerability affects your stack