Mattermost server versions 11.3.x through 11.3.0, 11.2.x through 11.2.2, and 10.11.x through 10.11.10 fail to correctly handle incorrectly reported array lengths in MsgPack frames sent via WebSocket to the Calls plugin. The resulting out‑of‑memory error causes the server process to crash, creating a denial‑of‑service condition for all users. This weakness is identified as CWE‑1287 (Incorrect Handling of Array Lengths).

Affected systems are Mattermost installations running any of the following: 11.3.x up to and including 11.3.0, 11.2.x up to and including 11.2.2, or 10.11.x up to and including 10.11.10. The vendor recommends updating the server to 11.4.0, 11.3.1, 11.2.3, 10.11.11, or a subsequent release that includes the fix.

The CVSS score of 5.8 indicates moderate impact with a medium level of complexity. The EPSS value of less than 1% suggests a low probability that exploitation will occur in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is likely remote; an attacker can send specially crafted WebSocket messages to the Calls plugin to trigger the crash. The impacts affect confidentiality and integrity indirectly by disrupting service availability for all users on the affected Mattermost server.