What is GHSA-mfv9-qx66-gxm4?

GHSA-mfv9-qx66-gxm4 is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22...

Which CVE IDs does GHSA-mfv9-qx66-gxm4 cover?

GHSA-mfv9-qx66-gxm4 covers the following CVE IDs: CVE-2026-12882. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mfv9-qx66-gxm4?

GHSA-mfv9-qx66-gxm4 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-mfv9-qx66-gxm4MediumCVSS 4.3

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22...

Vendor

GitHub Security Advisories

Published

September 14, 2026

Last Modified

September 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-12882 →

📋 Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-12882
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-mfv9-qx66-gxm4