CVE-2026-43507 | Medium | 5.3 | 2026-05-01 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML pars… |
CVE-2026-43506 | Medium | 5.3 | 2026-05-01 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory l… |
CVE-2026-43505 | Medium | 6.5 | 2026-05-01 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access con… |
CVE-2026-43504 | Medium | 6.5 | 2026-05-01 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access con… |
CVE-2022-0217 | High | 7.5 | 2022-08-26 | It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given… |
CVE-2021-37601 | High | 7.5 | 2021-07-30 | muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a… |
CVE-2021-32921 | Medium | 5.9 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or… |
CVE-2021-32920 | High | 7.5 | 2021-05-13 | Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. |
CVE-2021-32919 | High | 7.5 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-… |
CVE-2021-32918 | High | 7.5 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaust… |
CVE-2021-32917 | Medium | 5.3 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the… |
CVE-2020-8086 | Critical | 9.8 | 2020-01-28 | The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. T… |
CVE-2018-10847 | Medium | 4.2 | 2018-07-30 | prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session r… |
CVE-2017-18265 | High | 7.5 | 2018-05-09 | Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaS… |
CVE-2016-0756 | Medium | 5.3 | 2016-01-29 | The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allow… |
CVE-2016-1232 | High | 7.5 | 2016-01-12 | The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, whi… |
CVE-2016-1231 | Medium | 5.9 | 2016-01-12 | Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary file… |
CVE-2014-2745 | | | 2014-04-11 | Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource… |
CVE-2014-2744 | | | 2014-04-11 | plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticat… |
CVE-2011-2532 | | | 2011-06-22 | The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid J… |
CVE-2011-2531 | | | 2011-06-22 | Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cau… |
CVE-2011-2205 | | | 2011-06-22 | Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU con… |