CVE-2025-12689CWE-1287

CVE-2025-12689

Medium · published December 18, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-1287 · Improper Validation of Specified Type of Input
Published
2025-12-18T00:16Z
Affected products (3)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.11.0, < 10.11.710.11.7
mattermost/mattermost_server≥ 10.12.0, < 10.12.310.12.3
mattermost/mattermost_server≥ 11.0.0, < 11.0.511.0.5
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 17 DEC 18:14Z
    DoS in Calls plugin via malformed UTF-8 in WebSocket request
    cvelistv5