Medium
Unbounded zlib decompression in Calls SDP WebSocket messages
Type: advisorySources: OSV
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-5132
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 10:20 UTC · Revision 1
Source evidence
Unbounded zlib decompression in Calls SDP WebSocket messages
core-osv · Original sourcePublished 14 Sept 2026, 10:41 UTC
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643
osv:CVE-2026-5132
Complete source record
{
"id": "35e6cafe23cdc62bdcb34a830d37ead34909fc862c541249434eb5a1fd8eacac",
"url": "https://osv.dev/vulnerability/CVE-2026-5132",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Unbounded zlib decompression in Calls SDP WebSocket messages",
"summary": "Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643",
"evidence": "osv:CVE-2026-5132",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-5132",
"aliases": [
"CVE-2026-5132"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mattermost/mattermost",
"type": "GIT",
"events": [
{
"introduced": "5b955468ea1ea8b56c0fb10feb258a36a767d7bb"
},
{
"fixed": "075d003e1391ff0b24eca1e63b0222eb46eaded6"
},
{
"introduced": "a9e574a82633915f22071f0d7ca2b006f249ec2a"
},
{
"fixed": "d42004bb3046de3ed176938a34b1a70c1c3d9421"
},
{
"introduced": "e8bd2b8a871cbeff6943bead62328478118188df"
},
{
"fixed": "d9c17e42b19c27dfac0ebe6840d954a41e626890"
},
{
"introduced": "583461af10fc9b2aef2871c722fc4376db695832"
},
{
"fixed": "1f738d345805168964a55e5860aac9c747dceb78"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.11.0"
},
{
"fixed": "10.11.23"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.7.0"
},
{
"fixed": "11.7.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.8.0"
},
{
"fixed": "11.8.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.9.0"
},
{
"fixed": "11.9.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v11.8.4",
"v11.7.7",
"v10.11.22",
"v11.9.0",
"mattermost-redux@11.9.0",
"@mattermost/types@11.9.0",
"@mattermost/shared@11.9.0",
"@mattermost/client@11.9.0",
"v11.8.3",
"v10.11.21",
"v11.7.6",
"v11.8.2",
"v11.7.5-rc1",
"v11.7.5",
"v11.8.1",
"v11.7.4",
"v11.7.3",
"v10.11.20",
"v11.8.0-rc5",
"v11.8.0",
"mattermost-redux@11.8.0",
"@mattermost/types@11.8.0",
"@mattermost/shared@11.8.0",
"@mattermost/client@11.8.0",
"v10.11.19",
"v10.11.19-rc1",
"v11.7.2",
"v10.11.18",
"v11.7.1",
"v10.11.17",
"v10.11.16",
"v11.7.0",
"mattermost-redux@11.7.0",
"@mattermost/types@11.7.0",
"@mattermost/shared@11.7.0",
"@mattermost/client@11.7.0",
"v10.11.15-rc1",
"v10.11.15",
"v10.11.14",
"v10.11.14-rc1",
"v10.11.13",
"v10.11.13-rc1",
"v10.11.12",
"v10.11.11-rc2",
"v10.11.11",
"v10.11.11-rc1",
"v10.11.10",
"v10.11.9",
"v10.11.9-rc1",
"v10.11.8",
"v10.11.7",
"v10.11.6",
"v10.11.5",
"v10.11.4-rc3",
"v10.11.4",
"v10.11.4-rc2",
"v10.11.4-rc1",
"v10.11.3",
"v10.11.2-rc2",
"v10.11.2",
"v10.11.2-rc1",
"v10.11.1",
"v10.11.1-rc1",
"v10.11.0-rc3",
"v10.11.0",
"mattermost-redux@10.11.0",
"@mattermost/types@10.11.0",
"@mattermost/client@10.11.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5132.json"
}
}
],
"modified": "2026-10-28T02:30:50.336741810Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5132.json",
"https://mattermost.com/security-updates",
"https://nvd.nist.gov/vuln/detail/CVE-2026-5132"
],
"provider_metadata": {
"cwe_ids": [
"CWE-409"
],
"cna_assigner": "Mattermost",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "11.9.0"
},
{
"last_affected": "11.9.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "11.8.0"
},
{
"last_affected": "11.8.4"
},
{
"introduced": "11.7.0"
},
{
"last_affected": "11.7.7"
},
{
"introduced": "10.11.0"
},
{
"last_affected": "10.11.22"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5132.json"
}
},
"related_cves": [
{
"value": "CVE-2026-5132",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518988,
"published_at": "2026-09-14T10:41:42.387+00:00"
}