{"id":"CVE-2026-115721","kind":"vulnerability","aliases":["CVE-2026-115721"],"related":[],"title":"Apache Vysper XMPP library: unbounded XML parsing allocation exhausts memory","description":"**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.\n\n\n\n\nThis issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library.\n\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.","summary":"Apache Vysper, an XMPP (Jabber) server library, allocates memory without bound while parsing XML. A crafted XML stream can drive the process out of memory and crash it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","self-hosted","xmpp"],"not_affected_if":["no-public-xmpp-endpoint","no-vysper-dependency"],"how_to_check":"- Check whether the project depends on Apache Vysper, for example by searching build files or lockfiles for `vysper`.\n- Confirm which Vysper version is in use; the sources say all versions are affected.","fix":"- No fixed release is planned because the project is retired; the sources recommend finding an alternative XMPP server library.\n- Until replaced, restrict which clients can reach the XMPP endpoint.","status":"open","published_at":"2026-10-26T16:17:17+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:32:56+00:00","updated_at":"2026-10-26T16:32:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T16:32:56Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed release is planned because the project is retired; the sources recommend finding an alternative XMPP server library.\n- Until replaced, restrict which clients can reach the XMPP endpoint.","reach":"network","title":"Apache Vysper XMPP library: unbounded XML parsing allocation exhausts memory","impact":"medium","summary":"Apache Vysper, an XMPP (Jabber) server library, allocates memory without bound while parsing XML. A crafted XML stream can drive the process out of memory and crash it.","category":"package","nicknames":[],"who_cares":["xmpp","java","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote input exhausts server memory, crashing the XMPP service","analyst_note":"Sources do not say whether unauthenticated XML input reaches the parser or what exact input size triggers it; check the NVD entry and Vysper's issue tracker.","how_to_check":"- Check whether the project depends on Apache Vysper, for example by searching build files or lockfiles for `vysper`.\n- Confirm which Vysper version is in use; the sources say all versions are affected.","needs_analyst":true,"not_affected_if":["no-vysper-dependency","no-public-xmpp-endpoint"],"who_is_affected":"Teams that embed Apache Vysper to run an XMPP server exposed to untrusted clients are affected, since the flaw is triggered by parsing incoming XML. Systems that do not use Vysper, or that only talk to XMPP servers built on other libraries, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000626,"input_tokens":3375,"output_tokens":578,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115721':13A,16A '-2026':12A,15A 'affect':73C 'alloc':8A,30B,54C 'altern':110C 'apach':1A,23B,59C,77C,79C 'assign':52C 'bound':33B 'condit':70C 'craft':38B 'crash':49B 'cve':11A,14A 'drive':42B 'exhaust':9A 'find':108C 'fix':101C 'host':21B 'issu':72C,103C 'jabber':27B,84C 'java':17B 'lead':64C 'librari':4A,29B,86C 'may':63C 'memori':10A,31B,47B,69C 'packag':18B 'pars':7A,35B,57C 'plan':95C 'process':44B 'project':89C 'recommend':106C 'releas':97C 'retir':91C 'self':20B 'self-host':19B 'server':28B,85C 'stream':40B 'unbound':5A,53C 'unsupport':50C 'user':104C 'version':62C,75C,99C 'vysper':2A,24B,60C,78C,80C 'without':32B 'xml':6A,36B,39B,56C 'xmpp':3A,22B,26B,83C","nicknames":[],"mitigations":[],"who_affected":"Teams that embed Apache Vysper to run an XMPP server exposed to untrusted clients are affected, since the flaw is triggered by parsing incoming XML. Systems that do not use Vysper, or that only talk to XMPP servers built on other libraries, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115721","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115721","severity":null,"published_at":"2026-10-26T16:17:17+00:00","modified_at":"2026-10-26T16:17:17+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}