{"id":"CVE-2026-93850","kind":"vulnerability","aliases":["CVE-2026-93850"],"related":[],"title":"Mattermost: crafted PDF upload can exhaust server memory, causing denial of service","description":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769","summary":"Mattermost fails to limit how much text it extracts from an uploaded PDF, so a crafted PDF with a compressed stream that expands hugely can consume all server memory. An authenticated user can crash or stall the server by uploading it.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mattermost","package","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the Mattermost server version with `mattermost version` or the System Console; versions 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1 and 11.10.x through 11.10.1 are affected.","fix":"- Upgrade Mattermost to a fixed release for your branch; the specific fixed versions are unknown from the sources.\n- Check the Mattermost advisory MMSA-2026-00769 for the patched build numbers.","status":"open","published_at":"2026-10-26T15:16:46+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:03:47+00:00","updated_at":"2026-10-26T16:03:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T16:03:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mattermost to a fixed release for your branch; the specific fixed versions are unknown from the sources.\n- Check the Mattermost advisory MMSA-2026-00769 for the patched build numbers.","reach":"network","title":"Mattermost: crafted PDF upload can exhaust server memory, causing denial of service","impact":"medium","summary":"Mattermost fails to limit how much text it extracts from an uploaded PDF, so a crafted PDF with a compressed stream that expands hugely can consume all server memory. An authenticated user can crash or stall the server by uploading it.","category":"package","nicknames":[],"who_cares":["mattermost","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Server memory exhausted, causing denial of service for all users","analyst_note":"Find the fixed versions for each release line in MMSA-2026-00769 and confirm whether PDF text extraction is on by default.","how_to_check":"- Check the Mattermost server version with `mattermost version` or the System Console; versions 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1 and 11.10.x through 11.10.1 are affected.","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required"],"who_is_affected":"Self-hosted Mattermost servers on the affected 11.7, 11.8, 11.9 and 11.10 release lines where users can upload files and PDF text extraction is active. Teams on a managed Mattermost cloud instance are handled by the vendor; the sources do not say which configurations are exposed beyond this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000647,"input_tokens":3418,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-00769':127C '-2026':14A,17A,126C '-93850':15A,18A '..':121C '11.10':75C '11.10.1':77C '11.7':72C '11.7.10':74C '11.8':69C '11.8.5':71C '11.9':66C '11.9.1':68C 'advisori':123C 'allow':91C 'amount':118C 'authent':54B,93C 'bind':80C 'caus':9A,100C 'compress':43B,110C 'consum':49B 'content':111C 'craft':2A,39B,107C 'crash':57B 'cve':13A,16A 'denial':10A,102C 'exhaust':6A,96C 'expand':46B,113C 'extract':32B,85C 'fail':25B,78C 'host':23B 'huge':47B 'id':124C 'larg':117C 'limit':27B 'mattermost':1A,19B,24B,64C,122C 'memori':8A,52B,98C 'mmsa':125C 'much':29B 'packag':20B 'pdf':3A,36B,40B,89C,108C 'self':22B 'self-host':21B 'server':7A,51B,61B,97C 'servic':12A,104C 'stall':59B 'stream':44B,112C 'text':30B,84C,120C 'upload':4A,35B,63B,88C 'user':55B,94C 'version':65C 'via':105C 'volum':82C 'whose':109C 'x':67C,70C,73C,76C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Mattermost servers on the affected 11.7, 11.8, 11.9 and 11.10 release lines where users can upload files and PDF text extraction is active. Teams on a managed Mattermost cloud instance are handled by the vendor; the sources do not say which configurations are exposed beyond this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93850","severity":null,"published_at":"2026-10-26T15:16:46+00:00","modified_at":"2026-10-26T15:16:46+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}