CVE-2026-12882 Mattermost Markdown autolink parsing denial of service

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and...

CVE-2026-12882 Mattermost Markdown autolink parsing denial of service

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and...

CVE-2026-12882

Mattermost is affected by a denial of service vulnerability in its Markdown autolink parsing (CVE-2026-12882, MMSA-2026-00703). The parser fails to handle autolinks with unmatched trailing closing parentheses in linear time, allowing an authenticated user with post-creation permission to trigger ...

CVE-2026-12882 Mattermost Markdown autolink parsing denial of service

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and...

CVE-2026-12882

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and...

EUVD-2026-77363

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issue: CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption bsc1278097. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:4145-1 Security update for python-sqlparse

This update for python-sqlparse fixes the following issue: - CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption bsc1278097...

SUSE-SU-2026:4139-1 Security update for dovecot23

This update for dovecot23 fixes the following issues: - CVE-2024-23184: parsing of messages containing many address headers From, To, Cc, Bcc, etc. could be excessively CPU intensive bsc1229184. - CVE-2024-23185: large headers can cause resource exhaustion when parsing message bsc1229183. -...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-50276: Allocation of Resources Without Limits or Throttling

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...

CVE-2026-12882: Inefficient Algorithmic Complexity

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and...

MAL-2026-16203 Malicious code in faiss-cpu-avx512 (PyPI)

[email protected] through 1.9.7 on PyPI impersonates faiss-cpu and ships no FAISS code: faisscpuavx512/init.py fetchnative downloads an xz-compressed binary from https://files.catbox.moe/ ffoa50.xz in 1.9.0 to 1.9.3, 0oreqo.xz in 1.9.4, vwfr94.xz in 1.9.5, 3l3x0v.xz in 1.9.6, weu5u2.xz in...

PT-2026-91239

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost versions 11.8.x through 11.8.4 Mattermost versions 11.7.x through 11.7.8 Mattermost versions 10.11.x through 10.11.22 Description The server-side Markdown parser fails to limit nesting depth. This allows an...

Medium: nodejs24

Issue Overview: Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function's regex replacement and string-manipulation logi...

PT-2026-91142

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and...

Malicious code in faiss-cpu-avx512 (PyPI)

[email protected] through 1.9.7 on PyPI impersonates faiss-cpu and ships no FAISS code: faisscpuavx512/init.py fetchnative downloads an xz-compressed binary from https://files.catbox.moe/ ffoa50.xz in 1.9.0 to 1.9.3, 0oreqo.xz in 1.9.4, vwfr94.xz in 1.9.5, 3l3x0v.xz in 1.9.6, weu5u2.xz in...

CVE-2026-86349: Inefficient Algorithmic Complexity

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.8, 10.11.x = 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service CPU resource exhaustion via a crafted post containing deeply nested...