CVE-2025-12689

MEDIUM

Mattermost <11.0.4, <10.12.2, <10.11.6 - DoS

Title source: llm

Description

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.

References (1)

[Vendor Advisory] https://mattermost.com/security-updates

Scores

CVSS v3 6.5

EPSS 0.0012

EPSS Percentile 31.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-1287

Status published

Products (2)

mattermost/mattermost-plugin-calls 0 - 1.11.0Go

mattermost/mattermost_server 10.11.0 - 10.11.7

Published Dec 17, 2025

Tracked Since Feb 18, 2026