Mattermost versions 11.6.x and earlier, 11.5.x and earlier, 11.4.x and earlier, and 10.11.x and earlier fail to validate msgpack‑encoded WebSocket frames before allocating memory. An unauthenticated remote attacker can send a crafted binary WebSocket message to the public WebSocket endpoint, causing the server process to crash and resulting in a full service outage for all users. The vulnerability is a memory‑allocation flaw (CWE‑789).

Affected products are Mattermost Server releases 10.11.x through 11.6.x, specifically versions up to 10.11.14, 11.4.4, 11.5.3, and 11.6.0. The impact applies to all users of these versions regardless of authentication status.

The CVSS score of 7.5 indicates a high‑severity denial‑of‑service impact. EPSS is not available, but the absence of a CISA KEV listing suggests no widespread exploitation reports yet. The attack vector is likely remote and unauthenticated, requiring only the ability to connect to the publicly exposed WebSocket endpoint. No additional resources or privileged access are needed to trigger the crash, making the vulnerability broadly exploitable to anyone who can reach the endpoint.