CVE-2026-16251

The record

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response.. Mattermost Advisory ID: MMSA-2026-00726

Affected packages

Related vulnerabilities

• CVE-2026-119699 WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption… CWE-770
• CVE-2026-119701 WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows… CWE-770
• CVE-2026-119036 Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening… CWE-770
• CVE-2026-116128 Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded… CWE-770
• CVE-2026-107312 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for… CWE-770
• CVE-2026-119209 pypdf is a free and open-source pure-python PDF library. CWE-770
• CVE-2026-90991 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to… CWE-770
• CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps… CWE-770