Mattermost versions up to 11.10.0, 11.7.9, 11.9.1, and 11.8.5 do not limit the size of remote image responses that are buffered in memory during local image proxy fetches. An attacker can create an oversized image response, forcing the server to allocate more memory than intended and eventually exhaust available memory. This flaw is classified as an unbounded buffer (CWE-770) and can result in application slowdown or crash, thereby disrupting service availability for all users on the affected Mattermost instance.

Victims are installations of Mattermost using any of the following versions: 11.10.0 and earlier, 11.7.9 and earlier, 11.9.1 and earlier, 11.8.5 and earlier. Administrators should confirm their Mattermost version and apply the appropriate patch available from the vendor.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score is 0.28% (well below 1%), and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation. The attack appears to be remote, requiring a crafted HTTP request to the local image proxy endpoint. Successful exploitation could exhaust server memory, causing service interruption but not directly compromising data confidentiality or integrity.