Mattermost WebSocket Message Processing Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Mattermost versions 11.3.x through 11.3.0, 11.2.x through 11.2.2, and 10.11.x through 10.11.10. The issue arises from the application's failure to properly manage incorrectly reported array lengths, allowing a malicious user to send corrupted msgpack frames within WebSocket messages to the 'calls' plugin. This exploitation can cause out-of-memory errors and crash the server.

Impact

Exploitation of this vulnerability leads to out-of-memory errors, causing the server to crash.

Remediation

Users can upgrade to Mattermost versions 11.5.0 or 11.4.0 to address this vulnerability.