CVE-2026-5755— Denial of service via crafted TIFF file upload
Possible ATT&CK Techniques 2AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of ServiceAffected Version Matrix 11
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mattermost | Mattermost | 11.6.0≤ 11.6.0 | affected |
11.5.0≤ 11.5.2 | affected | ||
11.5.0≤ 11.5.3 | affected | ||
11.4.0≤ 11.4.4 | affected | ||
10.11.0≤ 10.11.14 | affected | ||
11.7.0 | unaffected | ||
11.6.1 | unaffected | ||
11.5.3 | unaffected | ||
| … +3 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-5755
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial of service via crafted TIFF file upload
Source: CVE Program / CVE List V5
Vulnerability Description
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.. Mattermost Advisory ID: MMSA-2026-00648
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Mattermost 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mattermost是美国Mattermost公司的一个开源协作平台。 Mattermost 11.6.0及之前的11.6.x版本、11.5.3及之前的11.5.x版本、11.4.4及之前的11.4.x版本和10.11.14及之前的10.11.x版本存在安全漏洞，该漏洞源于未验证TIFF IFD偏移量，可能导致经过身份验证的用户通过上传特制TIFF文件或发布URL造成服务器内存耗尽。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mattermost | Mattermost | 11.6.0 ~ 11.6.0 | - |
II. Public POCs for CVE-2026-5755
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-5755
请登录查看更多情报信息。
Same Patch Batch · Mattermost · 2026-05-22 · 8 CVEs total
| CVE-2026-5740 | 7.5 HIGH | Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server |
| CVE-2026-4635 | 6.5 MEDIUM | Persistent notification timing attack causing server denial of service |
| CVE-2026-3473 | 5.9 MEDIUM | Improper file ownership validation in the Boards API allows unauthorised file access |
| CVE-2026-28735 | 5.4 MEDIUM | GitHub OAuth Scope Validation |
| CVE-2026-5308 | 4.9 MEDIUM | Missing request body size limits on Zoom plugin HTTP endpoints |
| CVE-2026-4646 | 4.3 MEDIUM | Insufficient input validation in GitHub plugin API causes denial of service |
| CVE-2026-3636 | 4.3 MEDIUM | Sanitize team member data returned by API |
IV. Related Vulnerabilities
Same product: Mattermost
- CVE-2026-75587
Plaintext pre-auth secret exposure via Desktop App diagnosti - CVE-2026-9693
Mattermost thread memberships persist after team removal, ex - CVE-2026-9859
Mattermost Boards plugin didn’t enforce role-based authoriza - CVE-2026-9816
Insufficient server-side validation of board member role fie - CVE-2026-10080
Boards plugin panics on WebSocket command with non-string fi
Same vendor: Mattermost
- CVE-2026-75587
Plaintext pre-auth secret exposure via Desktop App diagnosti - CVE-2026-9693
Mattermost thread memberships persist after team removal, ex - CVE-2026-9859
Mattermost Boards plugin didn’t enforce role-based authoriza - CVE-2026-9816
Insufficient server-side validation of board member role fie - CVE-2026-10080
Boards plugin panics on WebSocket command with non-string fi
Same weakness: CWE-400
- CVE-2026-74903
SiYuan before v3.7.4 Insufficient Access Control via spinBlo - CVE-2026-65976
Deskflow: Clipboard receiver can accumulate data beyond Desk - CVE-2026-71486
vLLM: Derender endpoints decode caller-supplied GenerateResp - CVE-2026-17639
Certain HP Smart Tank All in One – Potential Denial of Servi - CVE-2026-59902
Netty: Memory Exhaustion in SctpMessageCompletionHandler
V. Comments for CVE-2026-5755
No comments yet