—

GO-2025-4255

Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in in github.com/mattermost/mattermost-plugin-calls

Quick fix

GO-2025-4255 — github.com/mattermost/mattermost-plugin-calls: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost-plugin-calls@v1.11.0

Details

Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in in github.com/mattermost/mattermost-plugin-calls

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost-plugin-calls

Introduced in: 0Fixed in: 1.11.0

Fixgo get github.com/mattermost/mattermost-plugin-calls@v1.11.0

References

https://github.com/advisories/GHSA-j5vq-62gr-8v3r[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2025-12689[ADVISORY]
https://github.com/mattermost/mattermost-plugin-calls/commit/f68b41980e1274e05cf91c687e2af1a73c5e36ca[FIX]
https://mattermost.com/security-updates[WEB]