CVE-2026-10600 Denial of service via unbounded document content extraction in Mattermost Server

Q: Is CVE-2026-10600 being exploited?

There is no known exploitation of CVE-2026-10600 in the wild and no public exploit code.

Medium 4.3 Published 27 Jul 2026 Updated 27 Jul 2026

Authenticated users can cause denial of service by uploading small documents that exhaust server resources during content extraction.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-10600?

CVE-2026-10600 is a medium-severity denial of service vulnerability in Mattermost Mattermost Server, published on 27 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.. Mattermost Advisory ID: MMSA-2026-00694

Weakness: CWE-770

Which versions are affected by CVE-2026-10600?

It affects 1 product.

Products include Mattermost Mattermost Server.

How do I fix CVE-2026-10600?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-10600 being exploited?

There is no known exploitation of CVE-2026-10600 in the wild and no public exploit code.

All Mattermost Mattermost Server vulnerabilities

Sources

Also known as GHSA-hmmp-647g-6q22, MINI-4m7p-rw8c-h6xp, MINI-mmmg-666r-h548.