CVE-2023-5967: Mattermost Denial of Service Vulnerability
Summary
CVE-2023-5967: Mattermost denial of service vulnerability. Affects github.com/mattermost/mattermost-server/v6 versions < 7.8.12. Fixed in 7.8.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mattermost is an open-source messaging platform that enables secure team collaboration. It is written in Go and provides various features such as messaging, file sharing, and voice/video calls. The vulnerability in question affects Mattermost's Calls plugin, which is responsible for handling voice and video calls within the platform.
Vulnerability Detail
The vulnerability arises from a failure in properly validating requests to the Calls plugin. An attacker can exploit this by sending a request without a User Agent header, causing a panic and crashing the Calls plugin. This denial of service vulnerability can disrupt voice and video call functionality, impacting the availability and reliability of the platform.
How To Fix
Latest published version: v6.7.2 as of 23 Oct 2026
go get github.com/mattermost/mattermost-server/v6@v6.7.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.8.12
This is the first release that contains the fix.
go get github.com/mattermost/mattermost-server/v6@v7.8.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by updating the affected packages to the fixed versions.
Conclusion
The Mattermost denial of service vulnerability in the Calls plugin can be mitigated by updating the affected packages to the fixed versions. This ensures the proper validation of requests and prevents the crashing of the Calls plugin. It is important to apply the recommended fix to maintain the availability and reliability of voice and video call functionality within Mattermost. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/mattermost/mattermost-server/v6 →
FAQ
The vulnerability can be exploited to cause a denial of service, leading to the crashing of the Calls plugin and disruption of voice and video call functionality within Mattermost.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Mattermost installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing an easy way to assess the impact on your application.
There are no known exploits for this vulnerability at the time of this advisory. However, it is crucial to apply the recommended fix to prevent potential exploitation.
No, the recommended fix involves updating the affected packages to the fixed versions. This ensures that the vulnerability is patched and the Calls plugin functions correctly.
You can find more information about this vulnerability, including the technical details and affected package versions, in the advisory provided by GitHub's advisory database. The link to the advisory is available in the 'database_specific' field of the affected package.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mattermost/mattermost-server/v6.
