Mattermost Denial-of-Service Vulnerability via Crafted WebSocket Messages

A denial-of-service vulnerability has been identified in Mattermost versions 11.6.0, 11.5.3, 11.4.4, and 10.11.14. The issue arises because the application fails to properly validate msgpack-encoded WebSocket frames before allocating memory. This flaw allows an unauthenticated remote attacker to send a malicious binary WebSocket message to the public WebSocket endpoint, crashing the server process and causing a complete service outage for all users.

Impact

Exploitation of this vulnerability leads to a server crash, causing a full service outage for all users.

Remediation

Users can upgrade to Mattermost versions 11.8.0 or 11.7.18 to address this vulnerability.