CVE-2026-86349 is a vulnerability in MatterMost
Published on September 14, 2026
Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested blockquotes or list items.. Mattermost Advisory ID: MMSA-2026-00707
Vulnerability Analysis
CVE-2026-86349 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Weakness Type
Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Products Associated with CVE-2026-86349
Want to know whenever a new CVE is published for MatterMost? stack.watch will email you.
Affected Versions
Mattermost:- Version 11.9.0, <= 11.9.0 is affected.
- Version 11.8.0, <= 11.8.4 is affected.
- Version 11.7.0, <= 11.7.8 is affected.
- Version 10.11.0, <= 10.11.22 is affected.
- Version 11.10.0 is unaffected.
- Version 11.9.1 is unaffected.
- Version 11.8.5 is unaffected.
- Version 11.7.9 is unaffected.
- Version 10.11.23 is unaffected.