Unbounded zlib decompression in Calls SDP WebSocket messages

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Mattermost/Mattermost (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Mattermost/Mattermost.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Sep 14, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 14, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 14, 2026

Sources and claim methodology

• Source referencemattermost.com

Related CVEs

• Playbooks channel action update validation issueSame mattermost/mattermost package
• Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.Same mattermost/mattermost package
• Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustionSame mattermost/mattermost package
• Mattermost Markdown autolink parsing denial of serviceSame mattermost/mattermost package
• Boards plugin denial of service via unvalidated block fields.propertiesSame mattermost/mattermost package
• Board archive import bypasses team board creation permissionsSame mattermost/mattermost package