{"id":"EUVD-2025-203918","revision":"79dc109d9fe44f5d82b81d8502e5dde3","records":[{"revision":"79dc109d9fe44f5d82b81d8502e5dde3","observedAt":"2026-11-09T02:10:59.159+00:00","statement":{"source":"euvd","id":"EUVD-2025-203918","aliases":["CVE-2025-12689","GHSA-j5vq-62gr-8v3r"],"title":"Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.","description":"Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":null}],"references":["https://mattermost.com/security-updates"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203918","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 17, 2025, 6:14:10 PM","dateUpdated":"Dec 17, 2025, 7:29:54 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-203918","identifiers":["EUVD-2025-203918","CVE-2025-12689","GHSA-j5vq-62gr-8v3r"]},"retained":false,"historicalAffected":[]}],"coverage":[]}