As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-115721: Apache Vysper: Unbounded allocation
CVE-2026-115721 is an unbounded allocation vulnerability in Apache Vysper's XML parsing affecting all versions that can trigger an out of memory condition. The project is retired and no patch is planned. The vulnerability carries a CVSS 3.1 score of 7.5 (high) with network-adjacent attack vector and no authentication required.
Why it matters: Organizations running any version of the retired Apache Vysper XMPP server face denial of service risk from remote attackers who can exploit XML parsing to exhaust memory; no official remediation is available and affected deployments must be decommissioned or replaced.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-115721: Apache Vysper: Unbounded allocation
CVE-2026-115721 affects all versions of Apache Vysper, a retired XMPP server library, and stems from unbounded allocation during XML parsing that can cause out of memory conditions. The vulnerability carries a CVSS 3.1 score of 7.5. Apache does not plan to address this issue given the project's retired status.
Why it matters: Organizations running any version of Apache Vysper for XMPP services face denial of service risk through memory exhaustion; patching is unlikely, so decommissioning or replacing the library should be prioritized.
- Source published
- First seen by Cybersecurity Tracker