PT-2026-36479 · Prosody · Prosody

Ley · Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-43504

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.12.6 Prosody versions 1.0.0 through 13.0.4

Description An issue exists when the mod proxy65 module is enabled. The mod proxy65 module mishandles access control during a paused scenario, which can lead to the relaying of unauthenticated traffic.

Recommendations Update to version 0.12.6 or later. Update to version 13.0.5 or later. As a temporary workaround, disable the mod proxy65 module to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-43504

Affected Products

Prosody

References · 10

• https://prosody.im/security/advisory_735dd9d3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43504 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43504 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43504 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43504 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43504 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43504 · Security Note
• https://openwall.com/lists/oss-security/2026/05/01/5 · Patch
• https://hg.prosody.im/trunk/rev/4bbb17445ed9 · Note
• https://t.me/CVEtracker/52429 · Telegram Post