PT-2026-36482 · Prosody · Prosody

Ley · Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-43507

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.12.6 Prosody versions 1.0.0 through 13.0.4

Description A Denial of Service can occur via memory exhaustion caused by XML parsing resource amplification from unauthenticated connections.

Recommendations Update to version 0.12.6 or later. Update to version 13.0.5 or later.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-43507

Affected Products

Prosody

References · 16

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43507 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43507 · Vendor Advisory
• https://openwall.com/lists/oss-security/2026/05/01/5 · Patch
• https://prosody.im/security/advisory_735dd9d3 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43507 · Security Note
• https://ubuntu.com/security/CVE-2026-43507 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43507 · Vendor Advisory
• https://hg.prosody.im/trunk/rev/8a4417d32b0f · Note
• https://hg.prosody.im/trunk/rev/a4327478678f · Note
• https://blog.unionium.org/ARTICLES/1.HTM · Note
• https://t.me/CVEtracker/52432 · Telegram Post
• https://hg.prosody.im/trunk/rev/166ac7d65cb6 · Note
• https://twitter.com/CVEnew/status/2050254029620461903 · Twitter Post
• https://hg.prosody.im/trunk/rev/1e005ba71f0d · Note