Apache Vysper CVE-2026-115721

Requires network reachability to an exposed Apache Vysper XMPP (Jabber) server endpoint that will parse attacker-supplied XML; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. The flaw affects all versions and is inherent to the XML parsing path, so no non-default configuration is indicated in the sources. The exact XML structure that triggers the unbounded allocation is not described in the available sources. The principal limiting factor is deployment: Vysper is a retired, dormant library, so exploitation depends on an organization still running an exposed instance; because the vendor will not patch, migration to an alternative XMPP server is the only stated remediation.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 high) describes a network-reachable, low-complexity, unauthenticated denial-of-service with availability-only impact and no confidentiality or integrity effect - consistent with an out-of-memory crash from unbounded allocation during XML parsing. The vuln.today decision label is 'awaiting_data', and no EPSS score, KEV listing, or PoC/exploit reference is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is tempered by two strong contextual signals the CVSS number does not capture: Apache Vysper is explicitly retired/dormant with no committers, and it is a specialized XMPP (Jabber) server library rather than widely deployed infrastructure, so the real-world attack surface is small despite the 'high' score. This is better characterized as a genuine but low-urgency availability flaw in an abandoned, niche product than a widespread emergency - the controlling mitigation is migration, since the vendor states no fix will be released. EPSS and KEV data are absent, not low, so prioritization rests on deployment footprint rather than measured exploitation probability.

A remote, unauthenticated attacker who can reach the Vysper XMPP service sends specially crafted XML (e.g., during XMPP stream processing) that triggers unbounded memory allocation in the parser, driving the Java process into an out-of-memory condition and taking the server down. The attack is network-based and low-complexity per the CVSS vector, requiring no credentials or user interaction, but no public exploit code is identified at time of analysis. The exact XML construct that triggers the allocation is not described in the available sources.