Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647
Update github.com/mattermost/mattermost-server to 11.6.1; github.com/mattermost/mattermost-server to 11.5.4; github.com/mattermost/mattermost-server to 11.4.5; github.com/mattermost/mattermost-server to 10.11.15; github.com/mattermost/mattermost/server/v8 to 8.0.0-20260410202636-17939826efa2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanMattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation affects github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost/server/v8 (go). Severity is high. Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647
AI coding agents often install or upgrade packages automatically in go. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range |
|---|
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647
Update github.com/mattermost/mattermost-server to 11.6.1; github.com/mattermost/mattermost-server to 11.5.4; github.com/mattermost/mattermost-server to 11.4.5; github.com/mattermost/mattermost-server to 10.11.15; github.com/mattermost/mattermost/server/v8 to 8.0.0-20260410202636-17939826efa2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanMattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation affects github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost/server/v8 (go). Severity is high. Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647
AI coding agents often install or upgrade packages automatically in go. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range |
|---|
| Fixed version |
|---|
| github.com/mattermost/mattermost-servergo | =11.6.0 | 11.6.1 |
|---|---|---|
| github.com/mattermost/mattermost-servergo | >=11.5.0,<11.5.4 | 11.5.4 |
| github.com/mattermost/mattermost-servergo | >=11.4.0,<11.4.5 | 11.4.5 |
| github.com/mattermost/mattermost-servergo | >=10.11.0,<10.11.15 | 10.11.15 |
| github.com/mattermost/mattermost/server/v8go | <8.0.0-20260410202636-17939826efa2 | 8.0.0-20260410202636-17939826efa2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Fixed version |
|---|
| github.com/mattermost/mattermost-servergo | =11.6.0 | 11.6.1 |
|---|---|---|
| github.com/mattermost/mattermost-servergo | >=11.5.0,<11.5.4 | 11.5.4 |
| github.com/mattermost/mattermost-servergo | >=11.4.0,<11.4.5 | 11.4.5 |
| github.com/mattermost/mattermost-servergo | >=10.11.0,<10.11.15 | 10.11.15 |
| github.com/mattermost/mattermost/server/v8go | <8.0.0-20260410202636-17939826efa2 | 8.0.0-20260410202636-17939826efa2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard