CVE-2026-93850

The record

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769

Affected packages

Related vulnerabilities

• CVE-2026-65059 Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression… CWE-409
• CVE-2026-117677 When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar… CWE-409
• CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning… CWE-409
• CVE-2026-118261 Echo is a Go web framework. CWE-409
• CVE-2026-111073 The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a… CWE-409
• CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce. CWE-409
• CVE-2026-116579 Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted… CWE-409
• CVE-2026-65627 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in… CWE-409