Prosody XMPP Server CVE-2026-43504

The mod_proxy65 module must be explicitly enabled in the Prosody configuration (included in the modules_enabled list in prosody.cfg.lua). Exploitation further requires the module to be in a paused state, a condition triggered by internal state transitions not fully documented in available sources but likely related to resource exhaustion, administrative pause signals, or specific error handling paths. Standard Prosody installations with mod_proxy65 disabled (the default) are not vulnerable. Unauthenticated network attackers can trigger the vulnerability with no prior credentials, user interaction, or special privileges required.

CVSS 6.5 (Medium) with network vector (AV:N), low complexity (AC:L), and no authentication requirement (PR:N) indicates a readily exploitable vulnerability accessible to any network attacker. The low CVSS impact ratings (Confidentiality: None, Integrity: Low, Availability: Low) suggest limited direct damage - the vulnerability enables unauthorized data relay and may degrade service rather than cause catastrophic system compromise. Notably, no EPSS score or KEV listing is available, which is unusual for a network-accessible auth-bypass but suggests either: (a) the vulnerability is module-specific and only affects deployments that explicitly enable mod_proxy65 (non-default in many XMPP configurations), or (b) the exploit requires specific knowledge of triggering pause conditions. Real-world risk depends critically on deployment scope: organizations running standard XMPP setups without media relay features are unaffected; those requiring XEP-0065 proxying (common in restricted network environments) face meaningful exposure. The authentication bypass nature elevates priority beyond the CVSS numeric score alone.

An attacker on the network sends crafted SOCKS5 bytestream requests directly to a Prosody server with mod_proxy65 enabled. If the module is in a paused state (triggered by server load, administrative pause, or error condition), the attacker's requests bypass the authentication checks that normally verify the requestor is an authorized XMPP client. The attacker can then relay arbitrary traffic through the proxy, potentially intercepting or injecting data intended for legitimate XMPP clients, or using the proxy to obscure the source of secondary attacks.