---
id: "CVE-2026-115721"
kind: "vulnerability"
aliases: ["CVE-2026-115721"]
title: "Apache Vysper XMPP library: unbounded XML parsing allocation exhausts memory"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "package", "self-hosted", "xmpp"]
not_affected_if: ["no-public-xmpp-endpoint", "no-vysper-dependency"]
published_at: "2026-10-26T16:17:17+00:00"
first_seen_at: "2026-10-26T16:31:01+00:00"
updated_at: "2026-10-26T16:32:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115721", "first_seen_at": "2026-10-26T16:31:01+00:00"}]
---

# Apache Vysper XMPP library: unbounded XML parsing allocation exhausts memory

Apache Vysper, an XMPP (Jabber) server library, allocates memory without bound while parsing XML. A crafted XML stream can drive the process out of memory and crash it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project depends on Apache Vysper, for example by searching build files or lockfiles for `vysper`.
- Confirm which Vysper version is in use; the sources say all versions are affected.

## Fix

- No fixed release is planned because the project is retired; the sources recommend finding an alternative XMPP server library.
- Until replaced, restrict which clients can reach the XMPP endpoint.

## Timeline

- 2026-10-26T16:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115721

## From the sources

**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.




This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library.




As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_