Vulnerability Details CVE-2026-14298
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 14.6%
CVSS Severity
CVSS v3 Score 6.5
Products affected by CVE-2026-14298
-
cpe:2.3:a:mattermost:mattermost_server:10.11.0
-
cpe:2.3:a:mattermost:mattermost_server:10.11.1
-
cpe:2.3:a:mattermost:mattermost_server:10.11.10
-
cpe:2.3:a:mattermost:mattermost_server:10.11.11
-
cpe:2.3:a:mattermost:mattermost_server:10.11.12
-
cpe:2.3:a:mattermost:mattermost_server:10.11.13
-
cpe:2.3:a:mattermost:mattermost_server:10.11.14
-
cpe:2.3:a:mattermost:mattermost_server:10.11.15
-
cpe:2.3:a:mattermost:mattermost_server:10.11.16
-
cpe:2.3:a:mattermost:mattermost_server:10.11.17
-
cpe:2.3:a:mattermost:mattermost_server:10.11.18
-
cpe:2.3:a:mattermost:mattermost_server:10.11.19
-
cpe:2.3:a:mattermost:mattermost_server:10.11.2
-
cpe:2.3:a:mattermost:mattermost_server:10.11.20
-
cpe:2.3:a:mattermost:mattermost_server:10.11.21
-
cpe:2.3:a:mattermost:mattermost_server:10.11.22
-
cpe:2.3:a:mattermost:mattermost_server:10.11.3
-
cpe:2.3:a:mattermost:mattermost_server:10.11.4
-
cpe:2.3:a:mattermost:mattermost_server:10.11.5
-
cpe:2.3:a:mattermost:mattermost_server:10.11.6
-
cpe:2.3:a:mattermost:mattermost_server:10.11.7
-
cpe:2.3:a:mattermost:mattermost_server:10.11.8
-
cpe:2.3:a:mattermost:mattermost_server:10.11.9
-
cpe:2.3:a:mattermost:mattermost_server:11.7.0
-
cpe:2.3:a:mattermost:mattermost_server:11.7.1
-
cpe:2.3:a:mattermost:mattermost_server:11.7.2
-
cpe:2.3:a:mattermost:mattermost_server:11.7.3
-
cpe:2.3:a:mattermost:mattermost_server:11.7.4
-
cpe:2.3:a:mattermost:mattermost_server:11.7.5
-
cpe:2.3:a:mattermost:mattermost_server:11.7.6
-
cpe:2.3:a:mattermost:mattermost_server:11.7.7
-
cpe:2.3:a:mattermost:mattermost_server:11.8.0
-
cpe:2.3:a:mattermost:mattermost_server:11.8.1
-
cpe:2.3:a:mattermost:mattermost_server:11.8.2
-
cpe:2.3:a:mattermost:mattermost_server:11.8.3
-
cpe:2.3:a:mattermost:mattermost_server:11.8.4
-
cpe:2.3:a:mattermost:mattermost_server:11.9.0