Technical impact
Mattermost versions prior to 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 contain a flaw in the Markdown auto‑link parser that fails to handle unmatched trailing closing parentheses efficiently. The flaw causes linear‑time parsing of a specially crafted string, resulting in excessive CPU consumption. This can degrade server performance and availability for all users. The weakness is classified as CWE‑407: Uncontrolled Resource Consumption.
Affected Systems
Mattermost installations running any of the following versions are affected: 11.9.0 or earlier, 11.8.4 or earlier, 11.7.7 or earlier, 10.11.22 or earlier. The vulnerability applies to all Mattermost instances that expose the standard posting API and render Markdown content in messages or attachments.
Risk and Exploitability
An attacker must be able to create a post, meaning the user needs the standard posting privilege. The attacker can then craft a message containing an improperly closed link that provokes the CPU spike. The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that, while exploitable, the current threat level is limited. Nonetheless, an authenticated user with posting rights can disrupt availability, especially on heavily used or resource‑constrained servers.
