CVE-2026-14298
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.. Mattermost Advisory ID: MMSA-2026-00713
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mattermost | Mattermost | 11.9.0 <= 11.9.0 | affected |
| Mattermost | Mattermost | 11.8.0 <= 11.8.4 | affected |
| Mattermost | Mattermost | 11.7.0 <= 11.7.7 | affected |
| Mattermost | Mattermost | 10.11.0 <= 10.11.22 | affected |
| Mattermost | Mattermost | 11.10.0 | unaffected |
| Mattermost | Mattermost | 11.9.1 | unaffected |
| Mattermost | Mattermost | 11.8.5 | unaffected |
| Mattermost | Mattermost | 11.7.8 | unaffected |
| Mattermost | Mattermost | 10.11.23 | unaffected |
Weaknesses
- CWE-409: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.