Mattermost allows an authenticated user to store an oversized notify_props.mention_keys list on their own profile, a CWE-770 deficiency in resource handling. The list is unbounded, and when the server processes a post it performs quadratic multibyte‑keyword matching against all keys. This leads to excessive CPU consumption and degraded post‑processing latency for every member of any channel the user shares. The flaw is a CPU‑exhaustion denial of service that can affect availability for channel participants.

Mattermost is the impacted platform. Versions 11.10.x up to 11.10.0, 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, and 11.7.x up to 11.7.10 are vulnerable. The vendor recommends updating to 11.11.0, 11.10.1, 11.9.2, 11.8.6, 11.7.11 or newer.

The CVSS score is 4.3, which rates as low severity. The EPSS score is 0.00212 (0.212%) and the issue is not listed in CISA’s KEV catalog. An attacker must be an authenticated user in a channel to exploit the flaw, but once logged in they can push an oversized mention_keys list that forces the server to consume high CPU and degrade service for all channel members.