· Zammad 6.5.5 is an exceptional security release addressing a critical vulnerability in the unsupported 6.5 series. It provides an emergency fix for customers who cannot immediately upgrade to a supported version.
Below, you’ll find the key details and recommended actions.
Zammad 6.5.5 provides an emergency security fix by hardening the WebSocket server code to address CVE-2026-102489
⚠️ Important note: Zammad 6.5.5 is only available through a new package repository. Administrators must switch to this repository before updating. Please follow the repository migration instructions.
Please note: Zammad 6.5 has reached end of support. This exceptional release is intended as a temporary security measure and does not extend its support lifecycle.
Zammad 6.5 users: Update to Zammad 6.5.5 immediately if upgrading to Zammad 7.2.2 is not yet possible.
All self-hosted users: We strongly recommend upgrading to Zammad 7.2.2 as soon as possible.
Zammad SaaS customers: No action is required.
String#utf8_encode and Object#to_utf8 will be removedAll details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#stringutf8_encode-and-objectto_utf8-will-be-removed
All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#debian-11-will-no-longer-be-supported
Exceptions::UnprocessableEntity will be removedAll details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#exceptionsunprocessableentity-will-be-removed
Rails.application.config.db_* values will be removedString#utf8_encode and Object#to_utf8 will be deprecated in favour of TextEncoding.utf8_encodeAll details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#import-mode-also-enables-maintenance-mode
admin.organization permission
