Mattermost 11.7.2: Markdown Parser DoS via Catastrophic Backtracking
CVE-2026-6850 Published on July 13, 2026

Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload that triggers catastrophic backtracking in the client-side markdown parser.. Mattermost Advisory ID: MMSA-2026-00658

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-6850 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a ReDoS Vulnerability?

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match. Backtracking becomes a weakness if all of these conditions are met:

CVE-2026-6850 has been classified to as a ReDoS vulnerability or weakness.


Products Associated with CVE-2026-6850

Want to know whenever a new CVE is published for MatterMost? stack.watch will email you.

MatterMost
 

Affected Versions

Mattermost: