CVE-2026-8683 Overly long URLs crash the Mattermost Desktop App

Q: Is CVE-2026-8683 being exploited?

There is no known exploitation of CVE-2026-8683 in the wild and no public exploit code.

Q: How do I fix CVE-2026-8683?

No fix has been published for CVE-2026-8683 yet. Limit exposure of the affected software until one is available.

Medium 6.5 Published 15 Jun 2026 Updated 15 Jun 2026

A malicious server owner can crash the Mattermost Desktop App by sending a script that opens an extremely long URL.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-8683?

CVE-2026-8683 is a medium-severity denial of service vulnerability in Mattermost, published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652

Weakness: CWE-770

Which versions are affected by CVE-2026-8683?

It affects 1 product.

Products include Mattermost Mattermost Desktop.

How do I fix CVE-2026-8683?

No fix has been published for CVE-2026-8683 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-8683 being exploited?

There is no known exploitation of CVE-2026-8683 in the wild and no public exploit code.

Sources

Also known as GHSA-pf78-3frq-v82v.