未評価
DoS in Calls plugin via malformed msgpack in websocket request.
CVE-2026-2454
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages to calls plugin. Mattermost Advisory ID: MMSA-2025-00537
参照URL
- advisory github.com
- advisory mattermost.com
- advisory nvd.nist.gov