{"id":"CVE-2026-93850","aliases":[],"title":"Unbounded memory consumption during PDF text extraction","titleSource":"Mattermost","descriptionSource":"Mattermost","products":[{"vendor":"Mattermost","name":"Mattermost","platforms":[],"versions":[{"version":"11.9.0","status":"affected","lessThanOrEqual":"11.9.1","versionType":"semver"},{"version":"11.8.0","status":"affected","lessThanOrEqual":"11.8.5","versionType":"semver"},{"version":"11.7.0","status":"affected","lessThanOrEqual":"11.7.10","versionType":"semver"},{"version":"11.10.0","status":"affected","lessThanOrEqual":"11.10.1","versionType":"semver"},{"version":"11.11.0","status":"unaffected"},{"version":"11.9.2","status":"unaffected"},{"version":"11.8.6","status":"unaffected"},{"version":"11.7.11","status":"unaffected"},{"version":"11.10.2","status":"unaffected"}],"defaultStatus":"unaffected","source":"Mattermost","url":"https://www.cve.org/CVERecord?id=CVE-2026-93850"}],"remediation":[{"text":"Update Mattermost to versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or higher.","source":"Mattermost","url":"https://www.cve.org/CVERecord?id=CVE-2026-93850"}],"description":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769","severity":"medium","score":6.5,"published":"2026-10-26T14:26:56.502Z","modified":"2026-10-26T16:46:45.587Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://mattermost.com/security-updates"],"sources":[{"name":"CVE","id":"CVE-2026-93850","modified":"2026-10-26T16:46:45.587Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93850"}],"assessments":[{"source":"Mattermost","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T05:10:30.667Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}