Live › vulnerability › CVE-2026-93850
Go to dashboardMattermost fails to limit how much text it extracts from an uploaded PDF, so a crafted PDF with a compressed stream that expands hugely can consume all server memory. An authenticated user can crash or stall the server by uploading it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Self-hosted Mattermost servers on the affected 11.7, 11.8, 11.9 and 11.10 release lines where users can upload files and PDF text extraction is active. Teams on a managed Mattermost cloud instance are handled by the vendor; the sources do not say which configurations are exposed beyond this.
No product ranges from the sources yet.
mattermost version or the System Console; versions 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1 and 11.10.x through 11.10.1 are affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769
This page as .md · .json · in your agent: get_signal("CVE-2026-93850")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.