EUVD-2026-26660Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
6DescriptionCVE.org
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML parsing resource amplification from unauthenticated connections.
AnalysisAI
Denial of service via memory exhaustion in Prosody before 0.12.6 and 1.0.0 through 13.0.4 allows unauthenticated remote attackers to crash the server through XML parsing resource amplification. An attacker can send specially crafted XML payloads to trigger excessive memory consumption without authentication, resulting in service unavailability with a CVSS score of 5.3 indicating low severity availability impact.
Technical ContextAI
Prosody is an XMPP (Extensible Messaging and Presence Protocol) server written in Lua. The vulnerability exploits the XML parsing subsystem commonly used to process incoming XMPP stanzas from client and server connections. XML resource amplification attacks, classified under CWE-770 (Allocation of Resources Without Limits or Throttling), leverage uncontrolled resource consumption during XML entity expansion or deeply nested XML structures. XMPP servers parse XML continuously as part of their core protocol functionality, making them inherently exposed to parsing-based denial of service attacks when resource limits are not properly enforced on untrusted input from unauthenticated connections.
RemediationAI
Upgrade Prosody to version 0.12.6 (for legacy 0.x deployments) or 13.0.5 or later (for current major versions). Organizations unable to immediately patch should implement per-connection rate limiting and XML parsing quotas at the firewall or load balancer level, specifically restricting XML document size and parsing depth from unauthenticated sources. Additionally, deploying connection timeouts and memory monitors for the Prosody process enables rapid detection and restart of DoS conditions. These compensating controls degrade user experience slightly (rejecting large valid stanzas) and require monitoring overhead but can reduce attack surface until patching occurs. Consult https://prosody.im/security/advisory_735dd9d3/ for patch specifics and any version-specific migration notes.
plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compr
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML feat
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, me
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Rated high severity (CVSS 8.8), this v
Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers
The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. Rated high seve
An issue was discovered in Prosody before 0.11.9. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
An issue was discovered in Prosody before 0.11.9. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
Unauthenticated traffic relay vulnerability in Prosody mod_proxy65 module allows network attackers to bypass access cont
Improper access control in Prosody's mod_proxy65 module allows unauthenticated relaying of traffic when the module enter
Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today