CVE-2026-43507

NameCVE-2026-43507
DescriptionAn issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML parsing resource amplification from unauthenticated connections.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6252-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
prosody (PTS)bullseye (security), bullseye0.11.9-2+deb11u2vulnerable
bookworm0.12.3-1vulnerable
bookworm (security)0.12.3-1+deb12u1fixed
trixie13.0.1-1vulnerable
trixie (security)13.0.1-1+deb131ufixed
forky, sid13.0.5-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
prosodysourcebookworm0.12.3-1+deb12u1DSA-6252-1
prosodysourcetrixie13.0.1-1+deb131uDSA-6252-1
prosodysource(unstable)13.0.5-1

Notes

https://prosody.im/security/advisory_735dd9d3/
https://hg.prosody.im/trunk/rev/8a4417d32b0f
https://hg.prosody.im/trunk/rev/166ac7d65cb6
https://hg.prosody.im/trunk/rev/a4327478678f
https://hg.prosody.im/trunk/rev/6c7549964d4d
https://hg.prosody.im/trunk/rev/1e005ba71f0d

Search for package or bug name: Reporting problems