Vulnerability · Published May 22, 2026 · Assigned by Mattermost
CVE-2026-5755Denial of service via crafted TIFF file upload
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.. Mattermost Advisory ID: MMSA-2026-00648
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | 11.6.1 | GHSA-37j2-3vv8-cf24 |
| Go | github.com/mattermost/mattermost-server | 11.5.4 | GHSA-37j2-3vv8-cf24 |
| Go | github.com/mattermost/mattermost-server | 11.4.5 | GHSA-37j2-3vv8-cf24 |
| Go | github.com/mattermost/mattermost-server | 10.11.15 | GHSA-37j2-3vv8-cf24 |
| Go | github.com/mattermost/mattermost-server | 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible, 11.6.1+incompatible | GO-2026-5835 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 11.6.0 – through 11.6.011.5.0 – through 11.5.211.5.0 – through 11.5.311.4.0 – through 11.4.410.11.0 – through 10.11.14 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- MMSA-2026-00648 vendor-advisory