CVE-2026-43507 Details

A denial-of-service vulnerability has been identified in Prosody XMPP server versions prior to 0.12.6 and 13.0.0 through 13.0.0 prior to 13.0.5. This vulnerability allows for memory exhaustion through XML parsing resource amplification, originating from unauthenticated connections. The issue exploits Prosody's per-connection rate limits, which are rendered less effective due to the disproportionate increase in memory usage compared to the volume of data sent by the attacker. Additionally, Prosody does not impose restrictions on the total number of connections, enabling an attacker to escalate the impact by utilizing multiple concurrent connections. The vulnerability also uncovers resource leaks, where a connection continues to deplete server resources even after the stream has ended.

Prosody users are advised to upgrade to version 13.0.5 or 0.12.6. For additional protection, review and adjust system firewall limits to manage the rate and total number of connections from individual IP addresses. This can be done using tools like 'ufw' to limit incoming connection requests on standard XMPP ports.