Servers and applications

CVE-2026-93850

Unbounded memory consumption during PDF text extraction

Severity: Medium 6.5
Published: 26 Oct 2026
Last changed: 2 Nov 2026
Added to UpHeron: 3 Nov 2026
Fixed in: 11.7.11, 11.8.6, 11.9.2, 11.10.2
Sources: NVD, CVE Program

Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769

Affected software

Software	Affected versions
MattermostServers and applications · `cna:mattermost\|mattermost`	From 11.7.0 up to 11.7.10 From 11.8.0 up to 11.8.5 From 11.9.0 up to 11.9.1 From 11.10.0 up to 11.10.1
MattermostServers and applications · `cpe:a:mattermost:mattermost_server`	From 11.7.0 before 11.7.11 From 11.8.0 before 11.8.6 From 11.9.0 before 11.9.2 From 11.10.0 before 11.10.2

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2026-93850
CVE.org https://www.cve.org/CVERecord?id=CVE-2026-93850