Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T11:17:03.050Z",
  "pubdate": "2026-09-14T11:17:03.050Z",
  "executiveSummary": "A Regular Expression Denial of Service (ReDoS) vulnerability exists within the Mattermost Markdown parsing engine. The flaw is triggered by the improper handling of autolinks containing unmatched trailing closing parentheses, which prevents the parser from operating in linear time.\nThis vulnerability affects Mattermost versions 11.9.0 and earlier, 11.8.4 and earlier, 11.7.7 and earlier, and 10.11.22 and earlier. By injecting a specially crafted Markdown string into a post or message attachment, an authenticated attacker can induce excessive CPU consumption.\nThe primary impact is a degradation of server availability, potentially leading to a denial-of-service condition for all users on the affected Mattermost instance. Exploitation is constrained to authenticated users who possess the necessary permissions to create posts or message attachments. Given the widespread use of Markdown in collaborative platforms, this vulnerability poses a significant risk to service stability, necessitating immediate patching to the latest secure versions provided by the vendor.",
  "technicalDetails": "The vulnerability originates from a computational complexity flaw in the Markdown autolink parsing logic, specifically where regular expressions fail to process inputs with unbalanced trailing parentheses within linear time complexity (O(n)). When the parser encounters such syntactically ambiguous or maliciously crafted autolink structures, the backtracking mechanism of the underlying regex engine experiences exponential growth in execution time.\nThe attack flow begins when an authenticated user submits a payload containing a crafted autolink via the standard post creation API or message attachment field. Upon submission, the Mattermost server-side rendering engine attempts to sanitize and parse the Markdown content. During this phase, the regex engine enters a state of catastrophic backtracking as it attempts to resolve the mismatched closing parentheses. Because the regex processing is typically performed synchronously within the worker process, this operation consumes a disproportionate amount of CPU cycles.\nThe vulnerable component is the internal Markdown processing library utilized by Mattermost to render user-generated content. Affected versions include 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, and 10.11.x <= 10.11.22. The requirement for authentication means that the attack surface is limited to registered users; however, in environments with open registration or compromised accounts, this restriction is trivial to bypass.\nPost-exploitation impact is characterized by CPU starvation of the application process. If multiple concurrent requests containing the malicious payload are sent, or if the payload is sufficiently complex, the server can experience total unavailability, preventing legitimate users from accessing the platform. The vulnerability does not allow for arbitrary code execution or unauthorized data exfiltration; it is strictly a resource exhaustion attack. The lack of linear-time validation for autolink markers indicates that the parser is insufficiently hardened against pathological inputs, allowing for the creation of payloads that trigger worst-case performance scenarios. Successful exploitation effectively blinds the system and forces administrative intervention, such as process restarts or manual database entry cleanup, to restore normal service operation."
}