Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-12689

Good to know:

icon
icon

Date: December 17, 2025

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.

Severity Score

Related Resources (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-12689
https://github.com/mattermost/mattermost
https://mattermost.com/security-updates
https://github.com/mattermost/mattermost-plugin-calls/commit/f68b41980e1274e05cf91c687e2af1a73c5e36ca
https://www.mend.io/vulnerability-database/CVE-2025-12689

Severity Score

Weakness Type (CWE)

Improper Validation of Specified Type of Input

CWE-1287

Top Fix

icon

Upgrade Version

Upgrade to version github.com/mattermost/mattermost - v10.11.7;github.com/mattermost/mattermost - v10.12.3;github.com/mattermost/mattermost - v11.0.5;github.com/mattermost/mattermost-plugin-calls - v1.11.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us