CVE-2026-2454CWE-1287

DoS in Calls plugin via malformed msgpack in websocket request.

Medium · published March 16, 2026

CVSS v3.1
5.8
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages to calls plugin. Mattermost Advisory ID: MMSA-2025-00537

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00285 · 20.0th percentile
Weakness
CWE-1287 · Improper Validation of Specified Type of Input
Published
2026-03-16T20:10Z
EPSS history
Timeline
  • 16 MAR 20:10Z
    DoS in Calls plugin via malformed msgpack in websocket request.
    cvelistv5