What is CVE-2026-15814?

CVE-2026-15814 is a medium-severity vulnerability in Mattermost, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 6.5/10. Published 2026-09-14.

How severe is CVE-2026-15814?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Mattermost

CVE-2026-15814

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Mattermost

Weakness classification (CWE)

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification)

References

responsibledisclosure@mattermost.com (vendor-advisory)

Frequently asked questions

What is CVE-2026-15814?: CVE-2026-15814 is a medium-severity vulnerability in Mattermost, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 6.5/10. Published 2026-09-14.
How severe is CVE-2026-15814?: Medium severity. CVSS v3 base score is 6.5 out of 10.