CVE-2026-16251 — Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

Mattermost versions 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.9.x through 11.9.1, and 11.8.x through 11.8.5 do not limit the size of remote image responses buffered in memory during local image proxy direct fetches. A remote attacker can cause server memory exhaustion באמצעות a crafted oversized image response.