Prosody vulnerabilities
Published CVEs affecting Prosody products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-43507
High · 7.5
CWE-770 May 1, 2026
Allocation of Resources Without Limits or Throttling in Prosody
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML parsing resource amplification from unauthenticated connections.
CVE-2026-43506
High · 7.5
CWE-401 May 1, 2026
Missing Release of Memory after Effective Lifetime in Prosody
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory leaks from unauthenticated connections.
CVE-2026-43505
Medium · 6.5
CWE-420 May 1, 2026
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5…
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43504
Medium · 6.5
CWE-863 May 1, 2026
Incorrect Authorization in Prosody
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.