CVE-2026-12882— Mattermost Markdown autolink parsing denial of service
Quick assessment
Affected
Mattermost Mattermost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mattermost是美国Mattermost公司开源的一个开源协作平台。 Mattermost 11.9.0及之前的11.9.x版本、11.8.4及之前的11.8.x版本、11.7.7及之前的11.7.x版本和10.11.22及之前的10.11.x版本存在资源管理错误漏洞，该漏洞源于未能在线性时间内解析带有未匹配尾部右括号的Markdown自动链接，可能导致具有创建帖子权限的认证用户通过特制帖子或消息附件内容造成服务器CPU过度消耗并降低其他用户可用性。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 9
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mattermost | Mattermost | 11.9.0≤ 11.9.0 |
affected |
11.8.0≤ 11.8.4 |
affected | ||
11.7.0≤ 11.7.7 |
affected | ||
10.11.0≤ 10.11.22 |
affected | ||
11.10.0 |
unaffected | ||
11.9.1 |
unaffected | ||
11.8.5 |
unaffected | ||
11.7.8 |
unaffected | ||
| … +1 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12882
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mattermost Markdown autolink parsing denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Vulnerability Title
Mattermost 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mattermost是美国Mattermost公司开源的一个开源协作平台。 Mattermost 11.9.0及之前的11.9.x版本、11.8.4及之前的11.8.x版本、11.7.7及之前的11.7.x版本和10.11.22及之前的10.11.x版本存在资源管理错误漏洞，该漏洞源于未能在线性时间内解析带有未匹配尾部右括号的Markdown自动链接，可能导致具有创建帖子权限的认证用户通过特制帖子或消息附件内容造成服务器CPU过度消耗并降低其他用户可用性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mattermost | Mattermost | 11.9.0 ~ 11.9.0 | - |
|
II. Public POCs for CVE-2026-12882
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12882
请登录查看更多情报信息。
Same Patch Batch · Mattermost · 2026-09-14 · 16 CVEs total
| CVE-2026-8821 | 7.1 HIGH | Playbooks run owner channel membership permission bypass |
| CVE-2026-12985 | 6.8 MEDIUM | Mattermost DCR redirect URI allowlist bypass via improper URL component validation |
| CVE-2026-15814 | 6.5 MEDIUM | Uploading a crafted image causes excessive memory allocation in the Mattermost Server |
| CVE-2026-9812 | 6.5 MEDIUM | Missing property field ownership validation in Playbooks run property update endpoint |
| CVE-2026-5132 | 6.5 MEDIUM | Unbounded zlib decompression in Calls SDP WebSocket messages |
| CVE-2026-91181 | 6.5 MEDIUM | Data Retention Teams Endpoint Leaks Private Team Invite ID |
| CVE-2026-82920 | 5.5 MEDIUM | Mattermost ABAC parent policy bypass via policy update endpoint |
| CVE-2026-10556 | 5.3 MEDIUM | Unauthenticated webhook request with null notification entry could crash the Microsoft Cal |
| CVE-2026-10542 | 5.0 MEDIUM | Playbooks channel action update validation issue |
| CVE-2026-11993 | 4.3 MEDIUM | Fix authenticated members disabling file content indexing server-wide via extraction pool |
| CVE-2026-14344 | 4.3 MEDIUM | Inconsistent authorization checks in Mattermost Boards endpoints |
| CVE-2026-14259 | 4.3 MEDIUM | Board archive import bypasses team board creation permissions |
| CVE-2026-13417 | 4.3 MEDIUM | Boards plugin denial of service via unvalidated block fields.properties |
| CVE-2026-86348 | 4.3 MEDIUM | MS Calendar plugin: unrecovered handler panics from malformed post-action requests could c |
| CVE-2026-86349 | 4.3 MEDIUM | Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting |
IV. Related Vulnerabilities
Same product: Mattermost
-
CVE-2026-93851
Path traversal in Mattermost Agents plugin mention reminder -
CVE-2026-93846
Team admin can escalate a team member's permissions via the -
CVE-2026-93848
Mattermost OpenID discovery endpoint request bypasses outbou -
CVE-2026-93850
Unbounded memory consumption during PDF text extraction -
CVE-2026-93849
Mattermost allows authenticated users to trigger excessive m
Same vendor: Mattermost
-
CVE-2026-93851
Path traversal in Mattermost Agents plugin mention reminder -
CVE-2026-93846
Team admin can escalate a team member's permissions via the -
CVE-2026-93848
Mattermost OpenID discovery endpoint request bypasses outbou -
CVE-2026-93850
Unbounded memory consumption during PDF text extraction -
CVE-2026-93849
Mattermost allows authenticated users to trigger excessive m
Same weakness: CWE-407
-
CVE-2026-119197
pyasn1: Quadratic-complexity denial of service in binary REA -
CVE-2026-119196
pyasn1: Quadratic CPU consumption in constructed BIT STRING -
CVE-2026-119195
pyasn1: Quadratic-time denial of service in constructed stri -
CVE-2026-119194
pyasn1: Quadratic CPU use in schemaless BER/CER/DER containe -
CVE-2019-25781
Python-Markdown 3.0 through 3.11.2 Denial of Service via Lin