sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-15814 Uploading a crafted image causes excessive memory allocation in the Mattermost Server

Medium 6.5 Published Updated

An authenticated user can cause server denial of service by uploading a crafted image that triggers excessive memory allocation.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2026-15814?

CVE-2026-15814 is a medium-severity denial of service vulnerability in Mattermost Mattermost Server, published on 14 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719

Weakness: CWE-409

Which versions are affected by CVE-2026-15814?

It affects 1 product.

Products include Mattermost Mattermost Server.

How do I fix CVE-2026-15814?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-15814 being exploited?

There is no known exploitation of CVE-2026-15814 in the wild and no public exploit code.

All Mattermost Mattermost Server vulnerabilities

Sources

Also known as GHSA-pf83-6pph-cpgr, MINI-mh6g-cqcx-j99p, MINI-vx37-73p8-52gh.

Is CVE-2026-15814 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free