CVE-2026-10600CWE-770denial-of-service

CVE-2026-10600

Medium · published July 27, 2026

CVSS v3.1

4.3

EPSS

Percentile

29.4

In the wild

Unconfirmed

What it is

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.. Mattermost Advisory ID: MMSA-2026-00694

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0: Not supplied
EPSS: 0.00367 · 29.4th percentile
Weakness: CWE-770 · Allocation of Resources Without Limits or Throttling
Published: 2026-07-27T19:16Z

Affected products (4)

Product	Versions	Fixed in
mattermost/mattermost_server	≥ 10.11.0, < 10.11.21	10.11.21
mattermost/mattermost_server	≥ 11.6.0, < 11.6.6	11.6.6
mattermost/mattermost_server	≥ 11.7.0, < 11.7.4	11.7.4
mattermost/mattermost_server	≥ 11.8.0, < 11.8.1	11.8.1

References (1)

https://mattermost.com/security-updates · [email protected]

EPSS history

Timeline

27 JUL 14:13Z
Denial of service via unbounded document content extraction in Mattermost Server
cvelistv5