Live › vulnerability › CVE-2026-112063
Go to dashboardlibstrophe, a C library for XMPP clients, has a stack buffer overflow in its SCRAM_Hi routine. A malicious XMPP server can send an oversized SCRAM salt, crashing the client or overwriting stack memory in NDEBUG builds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use libstrophe as an XMPP client and connect to XMPP servers, especially servers the team does not control, are exposed. The attack comes from the server side, so the risk is highest where a client connects to untrusted or third-party XMPP servers. Teams that only run XMPP servers or do not use libstrophe can skip it.
No product ranges from the sources yet.
libstrophe version from your package manager or pkg-config --modversion libstrophe) and see if it is 0.14.0 or earlier.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds.
This page as .md · .json · in your agent: get_signal("CVE-2026-112063")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.