{"id":"EUVD-2025-203918","enisaUuid":"d8e60809-343e-3477-9784-253ab44a1761","description":"Mattermost versions 11.0.x \u003c\u003d 11.0.4, 10.12.x \u003c\u003d 10.12.2, 10.11.x \u003c\u003d 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.","datePublished":"Dec 17, 2025, 6:14:10 PM","dateUpdated":"Dec 17, 2025, 7:29:54 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-12689\nGHSA-j5vq-62gr-8v3r\n","assigner":"Mattermost","epss":0.29,"enisaIdProduct":[{"id":"2a9959bf-7c12-3f2e-a7c0-4db87c08eb35","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.0.0 ≤11.0.4"},{"id":"3e4e920e-cdb4-3d9a-9871-f2c011038315","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.6"},{"id":"9aa71c04-9f28-32b9-999e-942b11cd4b39","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.2"}],"enisaIdVendor":[{"id":"d01a2b05-af95-346e-9415-190049420501","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"bbcd9fb9-f284-35c3-973f-f4ba407ffd9c","vulnerability":{"id":"GHSA-j5vq-62gr-8v3r","description":"Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in","datePublished":"Dec 17, 2025, 9:30:48 PM","dateUpdated":"Dec 20, 2025, 5:13:53 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-12689\nhttps://github.com/mattermost/mattermost-plugin-calls/commit/f68b41980e1274e05cf91c687e2af1a73c5e36ca\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-203918\n","aliases":"CVE-2025-12689\nGHSA-j5vq-62gr-8v3r\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:52:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fc419400-6889-3c87-a299-49f235bc026f","vulnerability":{"id":"CVE-2025-12689","description":"Mattermost versions 11.0.x \u003c\u003d 11.0.4, 10.12.x \u003c\u003d 10.12.2, 10.11.x \u003c\u003d 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.","datePublished":"Dec 17, 2025, 6:14:10 PM","dateUpdated":"Dec 17, 2025, 7:29:54 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-203918\n","assigner":"Mattermost","epss":0.29,"dataProcessed":"Oct 29, 2026, 7:16:50 AM","vulnerabilityProduct":[{"id":"0c221dde-ad1a-3906-a690-2d919e8de2ce","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.0.0 ≤11.0.4"},{"id":"1175d5fc-9bf1-3e8a-9758-1e5297619d6d","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.6"},{"id":"b9d426cd-1094-3aa8-a3b5-1e96c4290729","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.2"}],"vulnerabilityVendor":[{"id":"45ecd9ac-4c35-3595-a5bb-f29dd3d10e7a","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[]}