CVE-2026-12882

Mattermost versions 11.9.x up to 11.9.0, 11.8.x up to 11.8.4, 11.7.x up to 11.7.7, and 10.11.x up to 10.11.22 are vulnerable to a denial-of-service attack due to inefficient parsing of Markdown autolinks with unmatched trailing closing parentheses. An authenticated user can exploit this vulnerability by crafting specific post or message attachment content, leading to excessive CPU consumption and degraded service availability for other users. Organizations using affected Mattermost versions should prioritize patching to mitigate potential disruptions in service.