{"id":"CVE-2026-112063","kind":"vulnerability","aliases":["CVE-2026-112063"],"related":[],"title":"libstrophe: oversized SCRAM salt overflows a stack buffer in XMPP clients","description":"libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds.","summary":"libstrophe, a C library for XMPP clients, has a stack buffer overflow in its SCRAM_Hi routine. A malicious XMPP server can send an oversized SCRAM salt, crashing the client or overwriting stack memory in NDEBUG builds.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","libstrophe","package","xmpp"],"not_affected_if":["no-libstrophe","server-only","trusted-xmpp-servers-only"],"how_to_check":"- Check the installed libstrophe version (`libstrophe` version from your package manager or `pkg-config --modversion libstrophe`) and see if it is 0.14.0 or earlier.\n- Find builds that link libstrophe and confirm whether they are compiled with NDEBUG defined.","fix":null,"status":"open","published_at":"2026-10-18T13:16:38+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T04:05:47+00:00","updated_at":"2026-10-25T04:05:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:05:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"libstrophe: oversized SCRAM salt overflows a stack buffer in XMPP clients","impact":"medium","summary":"libstrophe, a C library for XMPP clients, has a stack buffer overflow in its SCRAM_Hi routine. A malicious XMPP server can send an oversized SCRAM salt, crashing the client or overwriting stack memory in NDEBUG builds.","category":"package","nicknames":[],"who_cares":["c","xmpp","libstrophe"],"confidence":0.6,"needs_auth":"no","worst_case":"Client crashes, or stack memory is overwritten in NDEBUG builds","analyst_note":"Find the upstream fixed version of libstrophe and the patch commit; the sources given do not name one, so how_to_check and fix remain unknown.","how_to_check":"- Check the installed libstrophe version (`libstrophe` version from your package manager or `pkg-config --modversion libstrophe`) and see if it is 0.14.0 or earlier.\n- Find builds that link libstrophe and confirm whether they are compiled with NDEBUG defined.","needs_analyst":true,"not_affected_if":["no-libstrophe","server-only","trusted-xmpp-servers-only"],"who_is_affected":"Applications that use libstrophe as an XMPP client and connect to XMPP servers, especially servers the team does not control, are exposed. The attack comes from the server side, so the risk is highest where a client connects to untrusted or third-party XMPP servers. Teams that only run XMPP servers or do not use libstrophe can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":3367,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112063':14A,17A '-2026':13A,16A '0.14.0':61C '124':106C '128':81C 'abort':108C 'allow':74C 'attack':91C 'attribut':101C 'base':66C 'buffer':8A,32B,67C,84C 'build':58B,117C 'byte':82C,107C 'c':18B,24B 'client':11A,28B,51B,110C 'contain':62C 'crash':49B 'cve':12A,15A 'decod':102C 'first':97C 'hi':37B,72C 'librari':25B 'libstroph':1A,19B,22B,59C 'malici':40B,75C 'memori':55B,114C 'messag':98C 'ndebug':57B,116C 'overflow':5A,33B,68C,79C 'overs':2A,46B,88C 'overwrit':53B,112C 'packag':20B 'routin':38B 'salt':4A,48B,90C 'scram':3A,36B,47B,71C,89C 'send':44B,86C,93C 'server':42B,77C,96C 'server-first-messag':95C 'stack':7A,31B,54B,65C,83C,113C 'stack-bas':64C 'vulner':69C 'whose':99C 'xmpp':10A,21B,27B,41B,76C","nicknames":[],"mitigations":[],"who_affected":"Applications that use libstrophe as an XMPP client and connect to XMPP servers, especially servers the team does not control, are exposed. The attack comes from the server side, so the risk is highest where a client connects to untrusted or third-party XMPP servers. Teams that only run XMPP servers or do not use libstrophe can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112063","severity":null,"published_at":"2026-10-18T13:16:38+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}