CVE-2026-10819CWE-409

CVE-2026-10819

Medium · published July 27, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.2
In the wild
Unconfirmed
What it is

Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom emoji.. Mattermost Advisory ID: MMSA-2026-00695

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.2th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2026-07-27T19:16Z
Affected products (4)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.11.0, < 10.11.2110.11.21
mattermost/mattermost_server≥ 11.6.0, < 11.6.611.6.6
mattermost/mattermost_server≥ 11.7.0, < 11.7.511.7.5
mattermost/mattermost_server≥ 11.8.0, < 11.8.211.8.2
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 27 JUL 14:15Z
    Mattermost Server Denial of Service via Animated GIF Emoji Upload
    cvelistv5