CVE-2026-5755: Mattermost Server DoS Vulnerability

CVE-2026-5755 Overview

CVE-2026-5755 affects multiple Mattermost Server releases that fail to validate the Tagged Image File Format (TIFF) Image File Directory (IFD) offset before allocating memory. Authenticated users with file upload or posting permissions can trigger an out-of-memory (OOM) condition on the server by uploading a crafted TIFF file or posting a URL that serves one. The flaw is tracked under Mattermost Advisory ID MMSA-2026-00648 and is categorized as uncontrolled resource consumption [CWE-400].

Critical Impact
A single authenticated user can exhaust server memory and cause a denial of service against the entire Mattermost deployment.

Affected Products

Mattermost Server 11.6.x <= 11.6.0
Mattermost Server 11.5.x <= 11.5.2 and 11.5.x <= 11.5.3
Mattermost Server 11.4.x <= 11.4.4 and 10.11.x <= 10.11.14

Discovery Timeline

2026-05-22 - CVE-2026-5755 published to the National Vulnerability Database (NVD)
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-5755

Vulnerability Analysis

The vulnerability resides in the TIFF image parsing path used by Mattermost Server when handling uploaded attachments or remote image previews. TIFF files use an Image File Directory (IFD) structure referenced by a 32-bit (or 64-bit for BigTIFF) offset in the file header. Mattermost reads this offset and allocates memory based on the declared structure size without first validating that the offset and entry counts are reasonable.

When the declared IFD offset or entry count is large, the server attempts to allocate a correspondingly large memory region. This results in an OOM termination of the Mattermost process and disrupts service for all users.

Root Cause

The root cause is missing input validation on attacker-controlled size fields within the TIFF header [CWE-400]. The parser trusts the IFD offset value before bounds-checking it against the actual file length, allowing unbounded memory allocation requests driven by attacker-supplied metadata.

Attack Vector

The attack vector is network-based and requires low privileges. Any authenticated user with file upload or message posting permissions can deliver the malicious TIFF in one of two ways. First, by uploading the crafted file directly as an attachment. Second, by posting a URL that serves the crafted TIFF, which triggers server-side fetching and parsing during link unfurling.

No user interaction is required from other participants, and confidentiality and integrity are not affected. The impact is limited to availability of the Mattermost service.

Detection Methods for CVE-2026-5755

Indicators of Compromise

Mattermost server process termination with OOM killer entries in dmesg or systemd journal logs.
Spikes in memory utilization correlated with file upload requests or link preview fetches involving TIFF content.
HTTP requests to /api/v4/files containing TIFF payloads from low-privilege accounts.
Outbound link unfurl requests to URLs returning image/tiffContent-Type headers from untrusted hosts.

Detection Strategies

Inspect Mattermost application logs for repeated panics or restarts following file upload or link preview events.
Monitor reverse proxy logs for uploads with TIFF magic bytes (II*\0 or MM\0*) and abnormally large declared offsets.
Correlate authenticated user upload activity with subsequent service degradation or container restarts.

Monitoring Recommendations

Configure resource monitoring on the Mattermost host to alert on rapid memory growth above baseline thresholds.
Enable audit logging for file upload events and link preview operations to attribute crash-inducing activity to specific user IDs.
Track container orchestrator restart counts for the Mattermost workload as a leading indicator of repeated exploitation.

How to Mitigate CVE-2026-5755

Immediate Actions Required

Upgrade Mattermost Server to a fixed release above 11.6.0, 11.5.3, 11.4.4, or 10.11.14 as published in the Mattermost security updates advisory.
Restrict file upload and posting permissions to trusted user roles where business requirements allow.
Apply host-level memory limits (cgroups or container memory caps) so an OOM event does not destabilize co-located services.

Patch Information

Mattermost has published fixed builds via the Mattermost Security Updates page under advisory MMSA-2026-00648. Administrators should consult the advisory for the exact patched version corresponding to their release branch and follow the standard Mattermost upgrade procedure.

Workarounds

Disable link previews for untrusted domains to prevent server-side fetching of attacker-hosted TIFF files.
Configure the upstream reverse proxy or web application firewall to block uploads with Content-Type: image/tiff until patching is complete.
Reduce the maximum file upload size in config.json under FileSettings.MaxFileSize to limit the surface for crafted payloads.

bash

# Configuration example: restrict upload size and disable link previews in config.json
{
  "ServiceSettings": {
    "EnableLinkPreviews": false
  },
  "FileSettings": {
    "MaxFileSize": 5242880
  }
}