# Zulip Server 11.5 — Zulip Server 11.5

- Product: Zulip Server (https://whatsnew.fyi/product/zulip-server)
- Vendor: Zulip
- Date: 2026-02-05
- Version: 11.5
- Original notes: https://github.com/zulip/zulip/releases/tag/11.5
- Permalink: https://whatsnew.fyi/product/zulip-server/releases/11.5

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fixed stored XSS vulnerabilities in administrative actions on user profiles susceptible through group names or channel names
- **added** — Offer a button when pasting to upload large pastes as a text file attachment
- **changed** — Changed the camo User-Agent to report itself as Zulip Server along with its version
- **fixed** — Fixed channel links for reminders in private channels
- **fixed** — Worked around a bug in Safari 17 with certain Unicode characters in user names
- **changed** — Improved the jump to first unread banner logic
- **fixed** — Fixed the behavior of the down arrow keyboard shortcut when the last message was long
- **fixed** — Fixed topic typeahead to never open downwards
- **removed** — Removed some unnecessary permissions previously requested by the Slack integration
- **changed** — Improved RocketChat import tooling
- **changed** — Improved Mattermost import tooling
- **fixed** — Fixed broken emoji in channel descriptions of imported organizations
- **fixed** — Fixed imports from Zulip exports which lacked some avatar thumbnails
- **changed** — Improved the initial installation experience when configuring proxies
- **added** — Added a postfix.uninstall setting in zulip.conf to leave postfix installed for sites using Postfix as an outgoing mailserver
- **added** — Added a application_server.custom_ca_path setting in zulip.conf to specify a custom CA to trust for OIDC servers with custom certificates
- **changed** — Replaced ./manage.py checkconfig with ./manage.py check and added more config validations to the checks
- **added** — Added additional validation of hostnames
- **changed** — Started respecting memory limits set from cgroups for Docker usage
- **changed** — Adjusted setup-certbot to run all hooks upon first install for Docker and sites moving from self-signed certs to Certbot

_Released 2026-02-05_

- CVE-2026-24050: Some administrative actions on the user profile were
  susceptible to stored XSS in group names or channel names. Exploiting
  these vulnerabilities required the user explicitly interacting with the
  problematic object.
- Start offering a button, when pasting, to upload large pastes as a text file
  attachment.
- Changed the camo `User-Agent` to report itself as Zulip Server, along with its
  version.
- Fixed channel links for reminders in private channels.
- Worked around a bug in Safari 17 with certain Unicode characters in user
  names.
- Improved the “jump to first unread?” banner logic.
- Fixed the behavior of the down arrow keyboard shortcut when the last message
  was long.
- Fixed topic typeahead to never open downwards.
- Removed some unnecessary permissions previously requested by the Slack
  integration.
- Improved RocketChat import tooling.
- Improved Mattermost import tooling.
- Updated Slack export instructions.
- Fixed broken emoji in channel descriptions of imported organizations.
- Fixed imports from Zulip exports, which lacked some avatar thumbnails.
- Improved the initial installation experience when configuring proxies.
- Added a `postfix.uninstall` setting in `zulip.conf` to leave `postfix`
  installed, for sites which use Postfix as an outgoing mailserver.
- Added a `application_server.custom_ca_path` setting in `zulip.conf` to
  specifying a custom CA to trust (e.g., for OIDC servers with custom
  certificates).
- Replaced `./manage.py checkconfig` with `./manage.py check`, and added more
  config validations to the checks.
- Added additional validation of hostnames.
- Started respecting memory limits set from cgroups, for Docker usage.
- Adjusted `setup-certbot` to run all hooks upon first install, both for Docker,
  and for sites moving from self-signed certs to Certbot.
- Degrade gracefully when `hunspell` stemming dictionaries are not installed
  (i.e. with a remote stock PostgreSQL) rather than requiring an install or
  configuration option.
- Allowed files in `/etc/zulip` to be symlinks to other locations.
- Start auto-generating Sphinx labels for documentation, not just header
  anchors.
- Simplified how `CREATE SCHEMA` and `search_path` is configured in PostgreSQL.
- Fixed a long-standing bug where metadata in S3 for attachments from the email
  gateway was incorrect.
- Move character-set detection for text content to before S3 upload, so it is
  stored there.
- Fixed a bug which mistakenly downloaded whole text file contents when
  attempting to guess their content-type.
- Added per-message incoming email server logging, and adjusted log levels of
  other email server processes.
- Added an `application_server.nginx_worker_processes` setting in `zulip.conf`
  to adjust the number of nginx `worker_processes`.
- Improved Tornado resharding tooling.
- Renamed GIF picker integrations to be generic.
- Updated translations from Weblate.