CVE-2026-15814
- Source
- https://cve.org/CVERecord?id=CVE-2026-15814
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15814.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-15814
- Downstream
- Published
- 2026-09-14T10:39:45Z
- Modified
- 2026-10-09T02:49:21Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Uploading a crafted image causes excessive memory allocation in the Mattermost Server
- Details
-
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719
- Database specific
{ "cna_assigner": "Mattermost", "cwe_ids": [ "CWE-409" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15814.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "11.8.0" }, { "last_affected": "11.8.4" }, { "introduced": "11.7.0" }, { "last_affected": "11.7.7" }, { "introduced": "10.11.0" }, { "last_affected": "10.11.22" }, { "introduced": "11.9.0" }, { "last_affected": "11.9.0" } ], "source": "AFFECTED_FIELD" } ] }- References
Affected packages
Git / github.com/mattermost/mattermost
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mattermost/mattermost
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "10.11.0" }, { "fixed": "10.11.23" }, { "introduced": "11.7.0" }, { "fixed": "11.7.8" }, { "introduced": "11.8.0" }, { "fixed": "11.8.5" }, { "introduced": "11.9.0" }, { "fixed": "11.9.1" } ], "source": "CPE_RANGE" }
Affected versions
@mattermost/client@10.*
@mattermost/client@10.11.0
@mattermost/client@11.*
@mattermost/client@11.7.0
@mattermost/client@11.8.0
@mattermost/client@11.9.0
@mattermost/shared@11.*
@mattermost/shared@11.7.0
@mattermost/shared@11.8.0
@mattermost/shared@11.9.0
@mattermost/types@10.*
@mattermost/types@10.11.0
@mattermost/types@11.*
@mattermost/types@11.7.0
@mattermost/types@11.8.0
@mattermost/types@11.9.0
mattermost-redux@10.*
mattermost-redux@10.11.0
mattermost-redux@11.*
mattermost-redux@11.7.0
mattermost-redux@11.8.0
mattermost-redux@11.9.0
v10.*
v10.11.0
v10.11.0-rc3
v10.11.1
v10.11.1-rc1
v10.11.10
v10.11.11
v10.11.11-rc1
v10.11.11-rc2
v10.11.12
v10.11.13
v10.11.13-rc1
v10.11.14
v10.11.14-rc1
v10.11.15
v10.11.15-rc1
v10.11.16
v10.11.17
v10.11.18
v10.11.19
v10.11.19-rc1
v10.11.2
v10.11.2-rc1
v10.11.2-rc2
v10.11.20
v10.11.21
v10.11.22
v10.11.3
v10.11.4
v10.11.4-rc1
v10.11.4-rc2
v10.11.4-rc3
v10.11.5
v10.11.6
v10.11.7
v10.11.8
v10.11.9
v10.11.9-rc1
v11.*
v11.7.0
v11.7.1
v11.7.2
v11.7.3
v11.7.4
v11.7.5
v11.7.5-rc1
v11.7.6
v11.7.7
v11.8.0
v11.8.0-rc5
v11.8.1
v11.8.2
v11.8.3
v11.8.4
v11.9.0